| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 14 | 15 | 0% |
| Commands | 0 | 3 | 0 | 0% |
| Section tags | 2 | 5 | 3 | 20% |
What each file covers
Sections
0 shared · 14 only in A · 15 only in B- − Development Guidelines
- − Technology Stack
- − When Source Code is Added
- − Always verify package.json exists first
- − Install dependencies with appropriate timeout
- − Build with extended timeout for AI projects
- − Run tests with adequate time
- − Build with reasonable timeout for most projects
- − AI Integration Best Practices
- − Preferred AI Dependencies
- − Code Organization
- − Error Handling Pattern
- − File Structure Standards
- − Development Workflow
- + Security Guidelines
- + API Key and Credential Management
- + Environment Variable Patterns
- + Required AI service keys
- + Optional service configurations
- + Security Best Practices
- + AI Service Security
- + Input Validation
- + Output Sanitization
- + Rate Limiting and Usage Control
- + Data Privacy and Compliance
- + User Data Handling
- + AI Service Data Policies
- + Error Handling Security
- + Production Security Checklist
Commands
0 shared · 3 only in A · 0 only in B- − npm install
- − npm run build
- − npm test
Section tags
2 shared · 5 only in A · 3 only in B- − build
- − test
- − architecture
- − dependencies
- − agent-behaviour
- + security
- + api
- + do-not
- setup
- code-style
Line diff
HerringtonDarkholme/megarepo · .clinerules/02-development.md
@@ −1 @@
1# Development Guidelines
2
3## Technology Stack
4This repository is pre-configured for **Node.js/Next.js development** with AI integrations.
5
6### When Source Code is Added
7Follow these patterns based on existing repository guidelines:
8
9```bash
10# Always verify package.json exists first
11test -f package.json && echo "Node.js project detected" || echo "No package.json found"
12
13# Install dependencies with appropriate timeout
14npm install # Allow 10+ minutes for completion
15
16# Build with extended timeout for AI projects
17npm run build # Allow 60+ minutes - AI projects can have complex builds
18
19# Run tests with adequate time
20npm test # Allow 30+ minutes for comprehensive test suites
21```
22# Build with reasonable timeout for most projects
23npm run build # Allow 15-30 minutes for most Node.js/Next.js builds with AI integrations
24
25# Run tests with adequate time
26npm test # Allow 30+ minutes for comprehensive test suites
27## AI Integration Best Practices
28
29### Preferred AI Dependencies
30When adding AI functionality, use these established packages:
31- `openai` - Official OpenAI API client
32- `@langchain/core` - LangChain framework for AI workflows
33- `@vercel/ai` - Vercel AI SDK for streaming and UI integration
34- `@huggingface/inference` - Hugging Face API client
35- `@anthropic-ai/sdk` - Anthropic Claude API client
36
37### Code Organization
38- Place AI client configurations in `src/lib/` directory
39- Create reusable AI components in `src/components/ai/`
40- Implement API routes for AI services in `src/app/api/` (Next.js App Router)
41- Define TypeScript types for AI responses in `src/types/`
42
43### Error Handling Pattern
44```javascript
45// Implement comprehensive error handling for AI services
46try {
47 const response = await aiClient.chat.completions.create({
48 model: "gpt-4",
49 messages: [{ role: "user", content: prompt }]
50 });
51 return response.choices[0].message.content;
52} catch (error) {
53 if (error.code === 'rate_limit_exceeded') {
54 throw new AIRateLimitError('Rate limit exceeded, please try again later');
55 }
56 if (error.code === 'insufficient_quota') {
57 throw new AIQuotaError('API quota exceeded');
58 }
59 throw new AIServiceError(`AI service failed: ${error.message}`);
60}
61```
62
63## File Structure Standards
64Follow the established minimal structure and expand thoughtfully:
65
66```
67.
68├── .clinerules/ # Cline AI rules (this directory)
69├── .github/ # GitHub workflows and Copilot instructions
70├── .kiro/steering/ # Kiro AI steering files
71├── .cursorrules # Cursor AI development rules
72├── CLAUDE.md # Claude AI specific configuration
73├── GEMINI.md # Gemini CLI configuration
74├── AGENT.md # Universal AI agent instructions
75├── package.json # Dependencies and scripts (when added)
76├── src/ # Source code (when added)
77│ ├── lib/ # AI clients and utilities
78│ ├── components/ # React components including AI components
79│ ├── app/ # Next.js App Router (pages and API routes)
80│ └── types/ # TypeScript definitions
81└── public/ # Static assets
82```
83
84## Development Workflow
851. **Before Changes**: Check repository state and existing patterns
862. **During Development**: Follow TypeScript best practices and AI patterns
873. **Testing**: Include AI service mocks and error scenario testing
884. **Documentation**: Update relevant AI configuration files as needed
HerringtonDarkholme/megarepo · .clinerules/04-security.md
@@ +1 @@
1# Security Guidelines
2
3## API Key and Credential Management
4**CRITICAL**: Never commit sensitive data to version control.
5
6### Environment Variable Patterns
7```bash
8# Required AI service keys
9OPENAI_API_KEY=sk-...
10ANTHROPIC_API_KEY=sk-ant-...
11HUGGINGFACE_API_KEY=hf_...
12
13# Optional service configurations
14AI_MODEL_TEMPERATURE=0.7
15AI_MAX_TOKENS=2048
16AI_RATE_LIMIT_PER_HOUR=100
17```
18
19### Security Best Practices
20- Use `.env.local` for development secrets (never commit)
21- Create `.env.example` with dummy values to document required variables
22- Implement API key rotation strategies for production deployments
23- Use secure key management services (AWS Secrets Manager, Azure Key Vault, etc.)
24- Validate API keys on application startup and fail fast if missing
25
26## AI Service Security
27
28### Input Validation
29Always validate and sanitize inputs to AI services:
30```javascript
31// Validate prompt length and content
32function validatePrompt(prompt) {
33 if (!prompt || typeof prompt !== 'string') {
34 throw new Error('Invalid prompt: must be a non-empty string');
35 }
36
37 if (prompt.length > 10000) {
38 throw new Error('Prompt too long: maximum 10,000 characters');
39 }
40
41 // Remove potential injection attacks
42 const sanitized = prompt.replace(/[<>]/g, '');
43 return sanitized;
44}
45```
46
47### Output Sanitization
48Sanitize AI service responses before displaying to users:
49```javascript
50// Sanitize AI responses for display
51function sanitizeAIResponse(response) {
52 // Remove potential script injections
53 return response
54 .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
55 .replace(/javascript:/gi, '')
56 .trim();
57}
58```
59
60### Rate Limiting and Usage Control
61Implement safeguards against API abuse:
62```javascript
63// Example rate limiting implementation
64const rateLimiter = new Map();
65
66function checkRateLimit(userId, maxRequests = 10, windowMs = 60000) {
67 const now = Date.now();
68 const userRequests = rateLimiter.get(userId) || [];
69
70 // Remove old requests outside the window
71 const validRequests = userRequests.filter(time => now - time < windowMs);
72
73 if (validRequests.length >= maxRequests) {
74 throw new Error('Rate limit exceeded');
75 }
76
77 validRequests.push(now);
78 rateLimiter.set(userId, validRequests);
79}
80```
81
82## Data Privacy and Compliance
83
84### User Data Handling
85- Never log sensitive user inputs or AI responses
86- Implement data retention policies for AI interactions
87- Consider GDPR and other privacy regulations
88- Provide user controls for data deletion
89
90### AI Service Data Policies
91- Understand data usage policies of each AI provider
92- Implement opt-out mechanisms for data training
93- Consider on-premise or private cloud AI solutions for sensitive data
94- Document data flow and processing for compliance audits
95
96## Error Handling Security
97Avoid exposing sensitive information in error messages:
98```javascript
99// Secure error handling
100try {
101 const response = await aiService.complete(prompt);
102 return response;
103} catch (error) {
104 // Log detailed error internally
105 console.error('AI service error:', error);
106
107 // Return generic error to user
108 throw new Error('AI service temporarily unavailable');
109}
110```
111
112## Production Security Checklist
113- [ ] All API keys stored in secure environment variables
114- [ ] Input validation implemented for all AI service calls
115- [ ] Output sanitization applied to AI responses
116- [ ] Rate limiting configured for API endpoints
117- [ ] Error messages don't expose sensitive information
118- [ ] Data retention policies documented and implemented
119- [ ] Security headers configured for web applications
120- [ ] HTTPS enforced for all AI service communications
@@ −1 +1 @@
1−# Development Guidelines
1+# Security Guidelines
22
3−## Technology Stack
4−This repository is pre-configured for **Node.js/Next.js development** with AI integrations.
3+## API Key and Credential Management
4+**CRITICAL**: Never commit sensitive data to version control.
55
6−### When Source Code is Added
7−Follow these patterns based on existing repository guidelines:
8−
6+### Environment Variable Patterns
97 ```bash
10−# Always verify package.json exists first
11−test -f package.json && echo "Node.js project detected" || echo "No package.json found"
8+# Required AI service keys
9+OPENAI_API_KEY=sk-...
10+ANTHROPIC_API_KEY=sk-ant-...
11+HUGGINGFACE_API_KEY=hf_...
1212
13−# Install dependencies with appropriate timeout
14−npm install # Allow 10+ minutes for completion
15−
16−# Build with extended timeout for AI projects
17−npm run build # Allow 60+ minutes - AI projects can have complex builds
18−
19−# Run tests with adequate time
20−npm test # Allow 30+ minutes for comprehensive test suites
13+# Optional service configurations
14+AI_MODEL_TEMPERATURE=0.7
15+AI_MAX_TOKENS=2048
16+AI_RATE_LIMIT_PER_HOUR=100
2117 ```
22−# Build with reasonable timeout for most projects
23−npm run build # Allow 15-30 minutes for most Node.js/Next.js builds with AI integrations
2418
25−# Run tests with adequate time
26−npm test # Allow 30+ minutes for comprehensive test suites
27−## AI Integration Best Practices
19+### Security Best Practices
20+- Use `.env.local` for development secrets (never commit)
21+- Create `.env.example` with dummy values to document required variables
22+- Implement API key rotation strategies for production deployments
23+- Use secure key management services (AWS Secrets Manager, Azure Key Vault, etc.)
24+- Validate API keys on application startup and fail fast if missing
2825
29−### Preferred AI Dependencies
30−When adding AI functionality, use these established packages:
31−- `openai` - Official OpenAI API client
32−- `@langchain/core` - LangChain framework for AI workflows
33−- `@vercel/ai` - Vercel AI SDK for streaming and UI integration
34−- `@huggingface/inference` - Hugging Face API client
35−- `@anthropic-ai/sdk` - Anthropic Claude API client
26+## AI Service Security
3627
37−### Code Organization
38−- Place AI client configurations in `src/lib/` directory
39−- Create reusable AI components in `src/components/ai/`
40−- Implement API routes for AI services in `src/app/api/` (Next.js App Router)
41−- Define TypeScript types for AI responses in `src/types/`
42−
43−### Error Handling Pattern
28+### Input Validation
29+Always validate and sanitize inputs to AI services:
4430 ```javascript
45−// Implement comprehensive error handling for AI services
46−try {
47− const response = await aiClient.chat.completions.create({
48− model: "gpt-4",
49− messages: [{ role: "user", content: prompt }]
50− });
51− return response.choices[0].message.content;
52−} catch (error) {
53− if (error.code === 'rate_limit_exceeded') {
54− throw new AIRateLimitError('Rate limit exceeded, please try again later');
31+// Validate prompt length and content
32+function validatePrompt(prompt) {
33+ if (!prompt || typeof prompt !== 'string') {
34+ throw new Error('Invalid prompt: must be a non-empty string');
5535 }
56− if (error.code === 'insufficient_quota') {
57− throw new AIQuotaError('API quota exceeded');
36+
37+ if (prompt.length > 10000) {
38+ throw new Error('Prompt too long: maximum 10,000 characters');
5839 }
59− throw new AIServiceError(`AI service failed: ${error.message}`);
40+
41+ // Remove potential injection attacks
42+ const sanitized = prompt.replace(/[<>]/g, '');
43+ return sanitized;
6044 }
6145 ```
6246
63−## File Structure Standards
64−Follow the established minimal structure and expand thoughtfully:
47+### Output Sanitization
48+Sanitize AI service responses before displaying to users:
49+```javascript
50+// Sanitize AI responses for display
51+function sanitizeAIResponse(response) {
52+ // Remove potential script injections
53+ return response
54+ .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
55+ .replace(/javascript:/gi, '')
56+ .trim();
57+}
58+```
6559
60+### Rate Limiting and Usage Control
61+Implement safeguards against API abuse:
62+```javascript
63+// Example rate limiting implementation
64+const rateLimiter = new Map();
65+
66+function checkRateLimit(userId, maxRequests = 10, windowMs = 60000) {
67+ const now = Date.now();
68+ const userRequests = rateLimiter.get(userId) || [];
69+
70+ // Remove old requests outside the window
71+ const validRequests = userRequests.filter(time => now - time < windowMs);
72+
73+ if (validRequests.length >= maxRequests) {
74+ throw new Error('Rate limit exceeded');
75+ }
76+
77+ validRequests.push(now);
78+ rateLimiter.set(userId, validRequests);
79+}
6680 ```
67−.
68−├── .clinerules/ # Cline AI rules (this directory)
69−├── .github/ # GitHub workflows and Copilot instructions
70−├── .kiro/steering/ # Kiro AI steering files
71−├── .cursorrules # Cursor AI development rules
72−├── CLAUDE.md # Claude AI specific configuration
73−├── GEMINI.md # Gemini CLI configuration
74−├── AGENT.md # Universal AI agent instructions
75−├── package.json # Dependencies and scripts (when added)
76−├── src/ # Source code (when added)
77−│ ├── lib/ # AI clients and utilities
78−│ ├── components/ # React components including AI components
79−│ ├── app/ # Next.js App Router (pages and API routes)
80−│ └── types/ # TypeScript definitions
81−└── public/ # Static assets
81+
82+## Data Privacy and Compliance
83+
84+### User Data Handling
85+- Never log sensitive user inputs or AI responses
86+- Implement data retention policies for AI interactions
87+- Consider GDPR and other privacy regulations
88+- Provide user controls for data deletion
89+
90+### AI Service Data Policies
91+- Understand data usage policies of each AI provider
92+- Implement opt-out mechanisms for data training
93+- Consider on-premise or private cloud AI solutions for sensitive data
94+- Document data flow and processing for compliance audits
95+
96+## Error Handling Security
97+Avoid exposing sensitive information in error messages:
98+```javascript
99+// Secure error handling
100+try {
101+ const response = await aiService.complete(prompt);
102+ return response;
103+} catch (error) {
104+ // Log detailed error internally
105+ console.error('AI service error:', error);
106+
107+ // Return generic error to user
108+ throw new Error('AI service temporarily unavailable');
109+}
82110 ```
83111
84−## Development Workflow
85−1. **Before Changes**: Check repository state and existing patterns
86−2. **During Development**: Follow TypeScript best practices and AI patterns
87−3. **Testing**: Include AI service mocks and error scenario testing
88−4. **Documentation**: Update relevant AI configuration files as needed
112+## Production Security Checklist
113+- [ ] All API keys stored in secure environment variables
114+- [ ] Input validation implemented for all AI service calls
115+- [ ] Output sanitization applied to AI responses
116+- [ ] Rate limiting configured for API endpoints
117+- [ ] Error messages don't expose sensitive information
118+- [ ] Data retention policies documented and implemented
119+- [ ] Security headers configured for web applications
120+- [ ] HTTPS enforced for all AI service communications
