| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 1 | 5 | 0% |
| Commands | 1 | 0 | 5 | 17% |
| Section tags | 2 | 3 | 4 | 22% |
What each file covers
Sections
0 shared · 1 only in A · 5 only in B- − OmniRoute PR and Coverage Instructions
- + Security and Cleanliness Rules for AI Assistants
- + 1. File Placement & Organization
- + 2. Hard Rules (mirror of `CLAUDE.md`)
- + 3. Codebase navigation
- + 4. Local development access
Commands
1 shared · 0 only in A · 5 only in B- + vitest.config.ts
- + eslint.config.mjs
- + playwright.config.ts
- + prettier.config.mjs
- + docker-compose*.yml
- npm run test:coverage
Section tags
2 shared · 3 only in A · 4 only in B- − code-style
- − testing-strategy
- − git-pr
- + lint-format
- + architecture
- + security
- + do-not
- test
- agent-behaviour
Line diff
diegosouzapw/OmniRoute · .github/copilot-instructions.md
@@ −1 @@
1# OmniRoute PR and Coverage Instructions
2
3- Treat `npm run test:coverage` as a required gate for PR work.
4- The repository minimum is `60%` for statements, lines, functions, and branches.
5- If a PR changes production code in `src/`, `open-sse/`, `electron/`, or `bin/`, it must include automated tests in the same PR.
6- When reviewing or updating a PR, if the report shows missing tests or coverage below `60%`, do not stop after reporting the problem. Add or update tests in the PR first, rerun the coverage gate, and only then ask for confirmation.
7- Prefer the smallest test layer that proves the behavior:
8 - unit tests first
9 - integration tests when multiple modules or DB state are involved
10 - e2e only when the behavior is truly UI or workflow-dependent
11- For bug issues, try to encode the reproduction as an automated test before or alongside the fix.
12- In the final PR report, include:
13 - the commands you ran
14 - the changed test files
15 - the final coverage result
16
diegosouzapw/OmniRoute · GEMINI.md
@@ +1 @@
1# Security and Cleanliness Rules for AI Assistants
2
3> **Scope:** rules for Gemini-based agents. For Claude Code, see `CLAUDE.md`. For other AI assistants, see `AGENTS.md`.
4
5## 1. File Placement & Organization
6
7- **Test Files**: ALL unit tests, integration tests, ecosystem tests, or Vitest files MUST strictly be placed within the `tests/` directory (e.g., `tests/unit/`, `tests/integration/`). NEVER create test files in the project root (`/`).
8- **Scripts and Utilities**: ALL maintenance, debugging, generation, or experimental scripts (`.cjs`, `.mjs`, `.js`, `.ts`) MUST be placed strictly inside one of the `scripts/` subfolders (`build/`, `dev/`, `check/`, `docs/`, `i18n/`, `ad-hoc/`). One-shot or experimental code goes under `scripts/ad-hoc/`. NEVER dump loose scripts in the project root (`/`) or the top-level `scripts/` folder.
9
10**The Project Root MUST ONLY CONTAIN:**
11
12- Configuration files (`vitest.config.ts`, `next.config.mjs`, `eslint.config.mjs`, `tsconfig*.json`, `playwright.config.ts`, `prettier.config.mjs`, `postcss.config.mjs`, `sonar-project.properties`, `fly.toml`, `docker-compose*.yml`, `Dockerfile`)
13- Dependency files (`package.json`, `package-lock.json`)
14- Documentation files (`README.md`, `CHANGELOG.md`, `LICENSE`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `llm.txt`, `Tuto_Qdrant.md`)
15- CI/CD files and ignore definitions (`.gitignore`, `.dockerignore`, `.npmignore`, `.npmrc`, `.node-version`, `.nvmrc`, `.env.example`)
16
17When creating _any_ validation tests or one-off logic scripts, default to using `scripts/ad-hoc/` or the `tests/unit/` directories according to your goals. Do not pollute the `/` root context.
18
19## 2. Hard Rules (mirror of `CLAUDE.md`)
20
211. **Never commit secrets or credentials.** Use `.env` (auto-generated from `.env.example`) or a vault. Passwords, OAuth secrets, API keys, and Cookie values must never appear in committed files.
222. **Never add logic to `src/lib/localDb.ts`.** It is a re-export barrel only.
233. **Never use `eval()`, `new Function()`, or any implied eval.** ESLint enforces this.
244. **Never commit directly to `main`.** Use `feat/`, `fix/`, `refactor/`, `docs/`, `test/`, or `chore/` branches.
255. **Never write raw SQL in routes** — always go through `src/lib/db/` domain modules.
266. **Never silently swallow errors in SSE streams** — propagate them or abort the stream cleanly.
277. **Never bypass Husky hooks** (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
288. **Always validate inputs with Zod schemas** from `src/shared/validation/schemas.ts`.
299. **Always include tests when changing production code** (`src/`, `open-sse/`, `electron/`, `bin/`).
3010. **Coverage must stay** ≥ 60 % statements / lines / functions / branches — the official CI gate (`npm run test:coverage`). The ratchet baseline in `quality-baseline.json` may freeze a higher floor; never regress it.
31
32## 3. Codebase navigation
33
34| Task | Read this first |
35| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| Understand the codebase | `docs/architecture/REPOSITORY_MAP.md` |
37| Architecture overview | `docs/architecture/ARCHITECTURE.md` |
38| Engineering reference | `docs/architecture/CODEBASE_DOCUMENTATION.md` |
39| Add a feature | `CONTRIBUTING.md` + the matching `docs/<area>.md` |
40| Per-area deep dives | `docs/frameworks/SKILLS.md`, `docs/frameworks/MEMORY.md`, `docs/frameworks/EVALS.md`, `docs/security/GUARDRAILS.md`, `docs/security/COMPLIANCE.md`, `docs/frameworks/CLOUD_AGENT.md`, `docs/frameworks/MCP-SERVER.md`, `docs/frameworks/A2A-SERVER.md`, `docs/architecture/AUTHZ_GUIDE.md`, `docs/architecture/RESILIENCE_GUIDE.md`, `docs/routing/AUTO-COMBO.md`, `docs/frameworks/WEBHOOKS.md`, `docs/routing/REASONING_REPLAY.md`, `docs/security/STEALTH_GUIDE.md`, `docs/ops/TUNNELS_GUIDE.md`, `docs/guides/ELECTRON_GUIDE.md`, `docs/reference/PROVIDER_REFERENCE.md` |
41| Release flow | `docs/ops/RELEASE_CHECKLIST.md` |
42
43## 4. Local development access
44
45The dashboard is reachable at the operator's chosen URL/port (default `http://localhost:20128`). Credentials are operator-specific:
46
47- **Initial admin password** is read from the `INITIAL_PASSWORD` env var on first install (defaults to `CHANGEME` in `.env.example`; rotate immediately after first login).
48- **Local VPS / shared dev environments**: ask the operator for the URL and current credentials — they live in their personal vault, NOT in this repo.
49
50> Any credential observed in a previous version of this file was a non-production demo value; treat it as compromised and do not reuse it.
51
@@ −1 +1 @@
1−# OmniRoute PR and Coverage Instructions
1+# Security and Cleanliness Rules for AI Assistants
22
3−- Treat `npm run test:coverage` as a required gate for PR work.
4−- The repository minimum is `60%` for statements, lines, functions, and branches.
5−- If a PR changes production code in `src/`, `open-sse/`, `electron/`, or `bin/`, it must include automated tests in the same PR.
6−- When reviewing or updating a PR, if the report shows missing tests or coverage below `60%`, do not stop after reporting the problem. Add or update tests in the PR first, rerun the coverage gate, and only then ask for confirmation.
7−- Prefer the smallest test layer that proves the behavior:
8− - unit tests first
9− - integration tests when multiple modules or DB state are involved
10− - e2e only when the behavior is truly UI or workflow-dependent
11−- For bug issues, try to encode the reproduction as an automated test before or alongside the fix.
12−- In the final PR report, include:
13− - the commands you ran
14− - the changed test files
15− - the final coverage result
3+> **Scope:** rules for Gemini-based agents. For Claude Code, see `CLAUDE.md`. For other AI assistants, see `AGENTS.md`.
4+
5+## 1. File Placement & Organization
6+
7+- **Test Files**: ALL unit tests, integration tests, ecosystem tests, or Vitest files MUST strictly be placed within the `tests/` directory (e.g., `tests/unit/`, `tests/integration/`). NEVER create test files in the project root (`/`).
8+- **Scripts and Utilities**: ALL maintenance, debugging, generation, or experimental scripts (`.cjs`, `.mjs`, `.js`, `.ts`) MUST be placed strictly inside one of the `scripts/` subfolders (`build/`, `dev/`, `check/`, `docs/`, `i18n/`, `ad-hoc/`). One-shot or experimental code goes under `scripts/ad-hoc/`. NEVER dump loose scripts in the project root (`/`) or the top-level `scripts/` folder.
9+
10+**The Project Root MUST ONLY CONTAIN:**
11+
12+- Configuration files (`vitest.config.ts`, `next.config.mjs`, `eslint.config.mjs`, `tsconfig*.json`, `playwright.config.ts`, `prettier.config.mjs`, `postcss.config.mjs`, `sonar-project.properties`, `fly.toml`, `docker-compose*.yml`, `Dockerfile`)
13+- Dependency files (`package.json`, `package-lock.json`)
14+- Documentation files (`README.md`, `CHANGELOG.md`, `LICENSE`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `llm.txt`, `Tuto_Qdrant.md`)
15+- CI/CD files and ignore definitions (`.gitignore`, `.dockerignore`, `.npmignore`, `.npmrc`, `.node-version`, `.nvmrc`, `.env.example`)
16+
17+When creating _any_ validation tests or one-off logic scripts, default to using `scripts/ad-hoc/` or the `tests/unit/` directories according to your goals. Do not pollute the `/` root context.
18+
19+## 2. Hard Rules (mirror of `CLAUDE.md`)
20+
21+1. **Never commit secrets or credentials.** Use `.env` (auto-generated from `.env.example`) or a vault. Passwords, OAuth secrets, API keys, and Cookie values must never appear in committed files.
22+2. **Never add logic to `src/lib/localDb.ts`.** It is a re-export barrel only.
23+3. **Never use `eval()`, `new Function()`, or any implied eval.** ESLint enforces this.
24+4. **Never commit directly to `main`.** Use `feat/`, `fix/`, `refactor/`, `docs/`, `test/`, or `chore/` branches.
25+5. **Never write raw SQL in routes** — always go through `src/lib/db/` domain modules.
26+6. **Never silently swallow errors in SSE streams** — propagate them or abort the stream cleanly.
27+7. **Never bypass Husky hooks** (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
28+8. **Always validate inputs with Zod schemas** from `src/shared/validation/schemas.ts`.
29+9. **Always include tests when changing production code** (`src/`, `open-sse/`, `electron/`, `bin/`).
30+10. **Coverage must stay** ≥ 60 % statements / lines / functions / branches — the official CI gate (`npm run test:coverage`). The ratchet baseline in `quality-baseline.json` may freeze a higher floor; never regress it.
31+
32+## 3. Codebase navigation
33+
34+| Task | Read this first |
35+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36+| Understand the codebase | `docs/architecture/REPOSITORY_MAP.md` |
37+| Architecture overview | `docs/architecture/ARCHITECTURE.md` |
38+| Engineering reference | `docs/architecture/CODEBASE_DOCUMENTATION.md` |
39+| Add a feature | `CONTRIBUTING.md` + the matching `docs/<area>.md` |
40+| Per-area deep dives | `docs/frameworks/SKILLS.md`, `docs/frameworks/MEMORY.md`, `docs/frameworks/EVALS.md`, `docs/security/GUARDRAILS.md`, `docs/security/COMPLIANCE.md`, `docs/frameworks/CLOUD_AGENT.md`, `docs/frameworks/MCP-SERVER.md`, `docs/frameworks/A2A-SERVER.md`, `docs/architecture/AUTHZ_GUIDE.md`, `docs/architecture/RESILIENCE_GUIDE.md`, `docs/routing/AUTO-COMBO.md`, `docs/frameworks/WEBHOOKS.md`, `docs/routing/REASONING_REPLAY.md`, `docs/security/STEALTH_GUIDE.md`, `docs/ops/TUNNELS_GUIDE.md`, `docs/guides/ELECTRON_GUIDE.md`, `docs/reference/PROVIDER_REFERENCE.md` |
41+| Release flow | `docs/ops/RELEASE_CHECKLIST.md` |
42+
43+## 4. Local development access
44+
45+The dashboard is reachable at the operator's chosen URL/port (default `http://localhost:20128`). Credentials are operator-specific:
46+
47+- **Initial admin password** is read from the `INITIAL_PASSWORD` env var on first install (defaults to `CHANGEME` in `.env.example`; rotate immediately after first login).
48+- **Local VPS / shared dev environments**: ask the operator for the URL and current credentials — they live in their personal vault, NOT in this repo.
49+
50+> Any credential observed in a previous version of this file was a non-production demo value; treat it as compromised and do not reuse it.
1651
