| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 14 | 11 | 0% |
| Commands | 0 | 3 | 0 | 0% |
| Section tags | 2 | 5 | 3 | 20% |
What each file covers
Sections
0 shared · 14 only in A · 11 only in B- − Development Guidelines
- − Technology Stack
- − When Source Code is Added
- − Always verify package.json exists first
- − Install dependencies with appropriate timeout
- − Build with extended timeout for AI projects
- − Run tests with adequate time
- − Build with reasonable timeout for most projects
- − AI Integration Best Practices
- − Preferred AI Dependencies
- − Code Organization
- − Error Handling Pattern
- − File Structure Standards
- − Development Workflow
- + Security & API Key Management
- + Core Security Principles
- + 1. API Key and Credential Management
- + 2. Environment Variable Patterns
- + AI Service Keys
- + Application Settings
- + Database (if needed)
- + 3. Data Privacy Guidelines
- + 4. API Security Best Practices
- + 5. Error Handling Security
- + 6. Rate Limiting and Monitoring
Commands
0 shared · 3 only in A · 0 only in B- − npm install
- − npm run build
- − npm test
Section tags
2 shared · 5 only in A · 3 only in B- − build
- − test
- − architecture
- − dependencies
- − agent-behaviour
- + security
- + database
- + api
- setup
- code-style
Line diff
HerringtonDarkholme/megarepo · .clinerules/02-development.md
@@ −1 @@
1# Development Guidelines
2
3## Technology Stack
4This repository is pre-configured for **Node.js/Next.js development** with AI integrations.
5
6### When Source Code is Added
7Follow these patterns based on existing repository guidelines:
8
9```bash
10# Always verify package.json exists first
11test -f package.json && echo "Node.js project detected" || echo "No package.json found"
12
13# Install dependencies with appropriate timeout
14npm install # Allow 10+ minutes for completion
15
16# Build with extended timeout for AI projects
17npm run build # Allow 60+ minutes - AI projects can have complex builds
18
19# Run tests with adequate time
20npm test # Allow 30+ minutes for comprehensive test suites
21```
22# Build with reasonable timeout for most projects
23npm run build # Allow 15-30 minutes for most Node.js/Next.js builds with AI integrations
24
25# Run tests with adequate time
26npm test # Allow 30+ minutes for comprehensive test suites
27## AI Integration Best Practices
28
29### Preferred AI Dependencies
30When adding AI functionality, use these established packages:
31- `openai` - Official OpenAI API client
32- `@langchain/core` - LangChain framework for AI workflows
33- `@vercel/ai` - Vercel AI SDK for streaming and UI integration
34- `@huggingface/inference` - Hugging Face API client
35- `@anthropic-ai/sdk` - Anthropic Claude API client
36
37### Code Organization
38- Place AI client configurations in `src/lib/` directory
39- Create reusable AI components in `src/components/ai/`
40- Implement API routes for AI services in `src/app/api/` (Next.js App Router)
41- Define TypeScript types for AI responses in `src/types/`
42
43### Error Handling Pattern
44```javascript
45// Implement comprehensive error handling for AI services
46try {
47 const response = await aiClient.chat.completions.create({
48 model: "gpt-4",
49 messages: [{ role: "user", content: prompt }]
50 });
51 return response.choices[0].message.content;
52} catch (error) {
53 if (error.code === 'rate_limit_exceeded') {
54 throw new AIRateLimitError('Rate limit exceeded, please try again later');
55 }
56 if (error.code === 'insufficient_quota') {
57 throw new AIQuotaError('API quota exceeded');
58 }
59 throw new AIServiceError(`AI service failed: ${error.message}`);
60}
61```
62
63## File Structure Standards
64Follow the established minimal structure and expand thoughtfully:
65
66```
67.
68├── .clinerules/ # Cline AI rules (this directory)
69├── .github/ # GitHub workflows and Copilot instructions
70├── .kiro/steering/ # Kiro AI steering files
71├── .cursorrules # Cursor AI development rules
72├── CLAUDE.md # Claude AI specific configuration
73├── GEMINI.md # Gemini CLI configuration
74├── AGENT.md # Universal AI agent instructions
75├── package.json # Dependencies and scripts (when added)
76├── src/ # Source code (when added)
77│ ├── lib/ # AI clients and utilities
78│ ├── components/ # React components including AI components
79│ ├── app/ # Next.js App Router (pages and API routes)
80│ └── types/ # TypeScript definitions
81└── public/ # Static assets
82```
83
84## Development Workflow
851. **Before Changes**: Check repository state and existing patterns
862. **During Development**: Follow TypeScript best practices and AI patterns
873. **Testing**: Include AI service mocks and error scenario testing
884. **Documentation**: Update relevant AI configuration files as needed
HerringtonDarkholme/megarepo · .cursor/rules/security.mdc
@@ +1 @@
1---
2description: "Security guidelines and API key management best practices"
3globs: ["**/*.env*", "**/*.config.*", "src/lib/**/*", "app/api/**/*"]
4alwaysApply: true
5---
6
7# Security & API Key Management
8
9Critical security guidelines for AI development in this repository.
10
11## Core Security Principles
12
13### 1. API Key and Credential Management
14- **NEVER** commit API keys, secrets, or credentials to version control
15- Always use environment variables for sensitive data
16- Create `.env.example` files to document required environment variables
17- Implement proper API key rotation and management patterns
18- Use secure storage solutions for production deployments
19
20### 2. Environment Variable Patterns
21Create `.env.local` with these patterns:
22```env
23# AI Service Keys
24OPENAI_API_KEY=your_openai_key_here
25ANTHROPIC_API_KEY=your_anthropic_key_here
26
27# Application Settings
28NEXT_PUBLIC_APP_URL=http://localhost:3000
29NODE_ENV=development
30
31# Database (if needed)
32DATABASE_URL=your_database_url_here
33```
34
35### 3. Data Privacy Guidelines
36- Avoid sending sensitive user data to AI services
37- Implement data anonymization where possible
38- Follow GDPR and privacy regulations
39- Document data usage and retention policies
40
41### 4. API Security Best Practices
42- Validate all inputs before sending to AI services
43- Implement proper CORS settings
44- Use HTTPS for all AI API communications
45- Regularly rotate API keys and secrets
46
47### 5. Error Handling Security
48```javascript
49// Secure error handling - don't expose sensitive details
50try {
51 const response = await aiClient.complete(prompt);
52 return response;
53} catch (error) {
54 // Log detailed error internally
55 logger.error('AI service error', { error, userId: user.id });
56
57 // Return generic error to client
58 throw new Error('AI service temporarily unavailable');
59}
60```
61
62### 6. Rate Limiting and Monitoring
63- Implement proper rate limiting for AI API endpoints
64- Monitor API usage and costs
65- Track unusual usage patterns
66- Implement health checks for AI services
@@ −1 +1 @@
1−# Development Guidelines
1+---
2+description: "Security guidelines and API key management best practices"
3+globs: ["**/*.env*", "**/*.config.*", "src/lib/**/*", "app/api/**/*"]
4+alwaysApply: true
5+---
26
3−## Technology Stack
4−This repository is pre-configured for **Node.js/Next.js development** with AI integrations.
7+# Security & API Key Management
58
6−### When Source Code is Added
7−Follow these patterns based on existing repository guidelines:
9+Critical security guidelines for AI development in this repository.
810
9−```bash
10−# Always verify package.json exists first
11−test -f package.json && echo "Node.js project detected" || echo "No package.json found"
11+## Core Security Principles
1212
13−# Install dependencies with appropriate timeout
14−npm install # Allow 10+ minutes for completion
13+### 1. API Key and Credential Management
14+- **NEVER** commit API keys, secrets, or credentials to version control
15+- Always use environment variables for sensitive data
16+- Create `.env.example` files to document required environment variables
17+- Implement proper API key rotation and management patterns
18+- Use secure storage solutions for production deployments
1519
16−# Build with extended timeout for AI projects
17−npm run build # Allow 60+ minutes - AI projects can have complex builds
20+### 2. Environment Variable Patterns
21+Create `.env.local` with these patterns:
22+```env
23+# AI Service Keys
24+OPENAI_API_KEY=your_openai_key_here
25+ANTHROPIC_API_KEY=your_anthropic_key_here
1826
19−# Run tests with adequate time
20−npm test # Allow 30+ minutes for comprehensive test suites
27+# Application Settings
28+NEXT_PUBLIC_APP_URL=http://localhost:3000
29+NODE_ENV=development
30+
31+# Database (if needed)
32+DATABASE_URL=your_database_url_here
2133 ```
22−# Build with reasonable timeout for most projects
23−npm run build # Allow 15-30 minutes for most Node.js/Next.js builds with AI integrations
2434
25−# Run tests with adequate time
26−npm test # Allow 30+ minutes for comprehensive test suites
27−## AI Integration Best Practices
35+### 3. Data Privacy Guidelines
36+- Avoid sending sensitive user data to AI services
37+- Implement data anonymization where possible
38+- Follow GDPR and privacy regulations
39+- Document data usage and retention policies
2840
29−### Preferred AI Dependencies
30−When adding AI functionality, use these established packages:
31−- `openai` - Official OpenAI API client
32−- `@langchain/core` - LangChain framework for AI workflows
33−- `@vercel/ai` - Vercel AI SDK for streaming and UI integration
34−- `@huggingface/inference` - Hugging Face API client
35−- `@anthropic-ai/sdk` - Anthropic Claude API client
41+### 4. API Security Best Practices
42+- Validate all inputs before sending to AI services
43+- Implement proper CORS settings
44+- Use HTTPS for all AI API communications
45+- Regularly rotate API keys and secrets
3646
37−### Code Organization
38−- Place AI client configurations in `src/lib/` directory
39−- Create reusable AI components in `src/components/ai/`
40−- Implement API routes for AI services in `src/app/api/` (Next.js App Router)
41−- Define TypeScript types for AI responses in `src/types/`
42−
43−### Error Handling Pattern
47+### 5. Error Handling Security
4448 ```javascript
45−// Implement comprehensive error handling for AI services
49+// Secure error handling - don't expose sensitive details
4650 try {
47− const response = await aiClient.chat.completions.create({
48− model: "gpt-4",
49− messages: [{ role: "user", content: prompt }]
50− });
51− return response.choices[0].message.content;
51+ const response = await aiClient.complete(prompt);
52+ return response;
5253 } catch (error) {
53− if (error.code === 'rate_limit_exceeded') {
54− throw new AIRateLimitError('Rate limit exceeded, please try again later');
55− }
56− if (error.code === 'insufficient_quota') {
57− throw new AIQuotaError('API quota exceeded');
58− }
59− throw new AIServiceError(`AI service failed: ${error.message}`);
54+ // Log detailed error internally
55+ logger.error('AI service error', { error, userId: user.id });
56+
57+ // Return generic error to client
58+ throw new Error('AI service temporarily unavailable');
6059 }
6160 ```
6261
63−## File Structure Standards
64−Follow the established minimal structure and expand thoughtfully:
65−
66−```
67−.
68−├── .clinerules/ # Cline AI rules (this directory)
69−├── .github/ # GitHub workflows and Copilot instructions
70−├── .kiro/steering/ # Kiro AI steering files
71−├── .cursorrules # Cursor AI development rules
72−├── CLAUDE.md # Claude AI specific configuration
73−├── GEMINI.md # Gemini CLI configuration
74−├── AGENT.md # Universal AI agent instructions
75−├── package.json # Dependencies and scripts (when added)
76−├── src/ # Source code (when added)
77−│ ├── lib/ # AI clients and utilities
78−│ ├── components/ # React components including AI components
79−│ ├── app/ # Next.js App Router (pages and API routes)
80−│ └── types/ # TypeScript definitions
81−└── public/ # Static assets
82−```
83−
84−## Development Workflow
85−1. **Before Changes**: Check repository state and existing patterns
86−2. **During Development**: Follow TypeScript best practices and AI patterns
87−3. **Testing**: Include AI service mocks and error scenario testing
88−4. **Documentation**: Update relevant AI configuration files as needed
62+### 6. Rate Limiting and Monitoring
63+- Implement proper rate limiting for AI API endpoints
64+- Monitor API usage and costs
65+- Track unusual usage patterns
66+- Implement health checks for AI services
