Two files, one repository
diegosouzapw/OmniRoute ships 4 formats across 6 indexed files. The question worth asking is whether the second one says anything the first does not.
| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 5 | 1 | 0% |
| Commands | 1 | 5 | 0 | 17% |
| Section tags | 2 | 4 | 3 | 22% |
What each file covers
Sections
0 shared · 5 only in A · 1 only in B- − Security and Cleanliness Rules for AI Assistants
- − 1. File Placement & Organization
- − 2. Hard Rules (mirror of `CLAUDE.md`)
- − 3. Codebase navigation
- − 4. Local development access
- + OmniRoute PR and Coverage Instructions
Commands
1 shared · 5 only in A · 0 only in B- − vitest.config.ts
- − eslint.config.mjs
- − playwright.config.ts
- − prettier.config.mjs
- − docker-compose*.yml
- npm run test:coverage
Section tags
2 shared · 4 only in A · 3 only in B- − lint-format
- − architecture
- − security
- − do-not
- + code-style
- + testing-strategy
- + git-pr
- test
- agent-behaviour
Line diff
diegosouzapw/OmniRoute · GEMINI.md
@@ −1 @@
1# Security and Cleanliness Rules for AI Assistants
2
3> **Scope:** rules for Gemini-based agents. For Claude Code, see `CLAUDE.md`. For other AI assistants, see `AGENTS.md`.
4
5## 1. File Placement & Organization
6
7- **Test Files**: ALL unit tests, integration tests, ecosystem tests, or Vitest files MUST strictly be placed within the `tests/` directory (e.g., `tests/unit/`, `tests/integration/`). NEVER create test files in the project root (`/`).
8- **Scripts and Utilities**: ALL maintenance, debugging, generation, or experimental scripts (`.cjs`, `.mjs`, `.js`, `.ts`) MUST be placed strictly inside one of the `scripts/` subfolders (`build/`, `dev/`, `check/`, `docs/`, `i18n/`, `ad-hoc/`). One-shot or experimental code goes under `scripts/ad-hoc/`. NEVER dump loose scripts in the project root (`/`) or the top-level `scripts/` folder.
9
10**The Project Root MUST ONLY CONTAIN:**
11
12- Configuration files (`vitest.config.ts`, `next.config.mjs`, `eslint.config.mjs`, `tsconfig*.json`, `playwright.config.ts`, `prettier.config.mjs`, `postcss.config.mjs`, `sonar-project.properties`, `fly.toml`, `docker-compose*.yml`, `Dockerfile`)
13- Dependency files (`package.json`, `package-lock.json`)
14- Documentation files (`README.md`, `CHANGELOG.md`, `LICENSE`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `llm.txt`, `Tuto_Qdrant.md`)
15- CI/CD files and ignore definitions (`.gitignore`, `.dockerignore`, `.npmignore`, `.npmrc`, `.node-version`, `.nvmrc`, `.env.example`)
16
17When creating _any_ validation tests or one-off logic scripts, default to using `scripts/ad-hoc/` or the `tests/unit/` directories according to your goals. Do not pollute the `/` root context.
18
19## 2. Hard Rules (mirror of `CLAUDE.md`)
20
211. **Never commit secrets or credentials.** Use `.env` (auto-generated from `.env.example`) or a vault. Passwords, OAuth secrets, API keys, and Cookie values must never appear in committed files.
222. **Never add logic to `src/lib/localDb.ts`.** It is a re-export barrel only.
233. **Never use `eval()`, `new Function()`, or any implied eval.** ESLint enforces this.
244. **Never commit directly to `main`.** Use `feat/`, `fix/`, `refactor/`, `docs/`, `test/`, or `chore/` branches.
255. **Never write raw SQL in routes** — always go through `src/lib/db/` domain modules.
266. **Never silently swallow errors in SSE streams** — propagate them or abort the stream cleanly.
277. **Never bypass Husky hooks** (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
288. **Always validate inputs with Zod schemas** from `src/shared/validation/schemas.ts`.
299. **Always include tests when changing production code** (`src/`, `open-sse/`, `electron/`, `bin/`).
3010. **Coverage must stay** ≥ 60 % statements / lines / functions / branches — the official CI gate (`npm run test:coverage`). The ratchet baseline in `quality-baseline.json` may freeze a higher floor; never regress it.
31
32## 3. Codebase navigation
33
34| Task | Read this first |
35| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| Understand the codebase | `docs/architecture/REPOSITORY_MAP.md` |
37| Architecture overview | `docs/architecture/ARCHITECTURE.md` |
38| Engineering reference | `docs/architecture/CODEBASE_DOCUMENTATION.md` |
39| Add a feature | `CONTRIBUTING.md` + the matching `docs/<area>.md` |
40| Per-area deep dives | `docs/frameworks/SKILLS.md`, `docs/frameworks/MEMORY.md`, `docs/frameworks/EVALS.md`, `docs/security/GUARDRAILS.md`, `docs/security/COMPLIANCE.md`, `docs/frameworks/CLOUD_AGENT.md`, `docs/frameworks/MCP-SERVER.md`, `docs/frameworks/A2A-SERVER.md`, `docs/architecture/AUTHZ_GUIDE.md`, `docs/architecture/RESILIENCE_GUIDE.md`, `docs/routing/AUTO-COMBO.md`, `docs/frameworks/WEBHOOKS.md`, `docs/routing/REASONING_REPLAY.md`, `docs/security/STEALTH_GUIDE.md`, `docs/ops/TUNNELS_GUIDE.md`, `docs/guides/ELECTRON_GUIDE.md`, `docs/reference/PROVIDER_REFERENCE.md` |
41| Release flow | `docs/ops/RELEASE_CHECKLIST.md` |
42
43## 4. Local development access
44
45The dashboard is reachable at the operator's chosen URL/port (default `http://localhost:20128`). Credentials are operator-specific:
46
47- **Initial admin password** is read from the `INITIAL_PASSWORD` env var on first install (defaults to `CHANGEME` in `.env.example`; rotate immediately after first login).
48- **Local VPS / shared dev environments**: ask the operator for the URL and current credentials — they live in their personal vault, NOT in this repo.
49
50> Any credential observed in a previous version of this file was a non-production demo value; treat it as compromised and do not reuse it.
51
diegosouzapw/OmniRoute · .github/copilot-instructions.md
@@ +1 @@
1# OmniRoute PR and Coverage Instructions
2
3- Treat `npm run test:coverage` as a required gate for PR work.
4- The repository minimum is `60%` for statements, lines, functions, and branches.
5- If a PR changes production code in `src/`, `open-sse/`, `electron/`, or `bin/`, it must include automated tests in the same PR.
6- When reviewing or updating a PR, if the report shows missing tests or coverage below `60%`, do not stop after reporting the problem. Add or update tests in the PR first, rerun the coverage gate, and only then ask for confirmation.
7- Prefer the smallest test layer that proves the behavior:
8 - unit tests first
9 - integration tests when multiple modules or DB state are involved
10 - e2e only when the behavior is truly UI or workflow-dependent
11- For bug issues, try to encode the reproduction as an automated test before or alongside the fix.
12- In the final PR report, include:
13 - the commands you ran
14 - the changed test files
15 - the final coverage result
16
@@ −1 +1 @@
1−# Security and Cleanliness Rules for AI Assistants
1+# OmniRoute PR and Coverage Instructions
22
3−> **Scope:** rules for Gemini-based agents. For Claude Code, see `CLAUDE.md`. For other AI assistants, see `AGENTS.md`.
4−
5−## 1. File Placement & Organization
6−
7−- **Test Files**: ALL unit tests, integration tests, ecosystem tests, or Vitest files MUST strictly be placed within the `tests/` directory (e.g., `tests/unit/`, `tests/integration/`). NEVER create test files in the project root (`/`).
8−- **Scripts and Utilities**: ALL maintenance, debugging, generation, or experimental scripts (`.cjs`, `.mjs`, `.js`, `.ts`) MUST be placed strictly inside one of the `scripts/` subfolders (`build/`, `dev/`, `check/`, `docs/`, `i18n/`, `ad-hoc/`). One-shot or experimental code goes under `scripts/ad-hoc/`. NEVER dump loose scripts in the project root (`/`) or the top-level `scripts/` folder.
9−
10−**The Project Root MUST ONLY CONTAIN:**
11−
12−- Configuration files (`vitest.config.ts`, `next.config.mjs`, `eslint.config.mjs`, `tsconfig*.json`, `playwright.config.ts`, `prettier.config.mjs`, `postcss.config.mjs`, `sonar-project.properties`, `fly.toml`, `docker-compose*.yml`, `Dockerfile`)
13−- Dependency files (`package.json`, `package-lock.json`)
14−- Documentation files (`README.md`, `CHANGELOG.md`, `LICENSE`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `llm.txt`, `Tuto_Qdrant.md`)
15−- CI/CD files and ignore definitions (`.gitignore`, `.dockerignore`, `.npmignore`, `.npmrc`, `.node-version`, `.nvmrc`, `.env.example`)
16−
17−When creating _any_ validation tests or one-off logic scripts, default to using `scripts/ad-hoc/` or the `tests/unit/` directories according to your goals. Do not pollute the `/` root context.
18−
19−## 2. Hard Rules (mirror of `CLAUDE.md`)
20−
21−1. **Never commit secrets or credentials.** Use `.env` (auto-generated from `.env.example`) or a vault. Passwords, OAuth secrets, API keys, and Cookie values must never appear in committed files.
22−2. **Never add logic to `src/lib/localDb.ts`.** It is a re-export barrel only.
23−3. **Never use `eval()`, `new Function()`, or any implied eval.** ESLint enforces this.
24−4. **Never commit directly to `main`.** Use `feat/`, `fix/`, `refactor/`, `docs/`, `test/`, or `chore/` branches.
25−5. **Never write raw SQL in routes** — always go through `src/lib/db/` domain modules.
26−6. **Never silently swallow errors in SSE streams** — propagate them or abort the stream cleanly.
27−7. **Never bypass Husky hooks** (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
28−8. **Always validate inputs with Zod schemas** from `src/shared/validation/schemas.ts`.
29−9. **Always include tests when changing production code** (`src/`, `open-sse/`, `electron/`, `bin/`).
30−10. **Coverage must stay** ≥ 60 % statements / lines / functions / branches — the official CI gate (`npm run test:coverage`). The ratchet baseline in `quality-baseline.json` may freeze a higher floor; never regress it.
31−
32−## 3. Codebase navigation
33−
34−| Task | Read this first |
35−| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36−| Understand the codebase | `docs/architecture/REPOSITORY_MAP.md` |
37−| Architecture overview | `docs/architecture/ARCHITECTURE.md` |
38−| Engineering reference | `docs/architecture/CODEBASE_DOCUMENTATION.md` |
39−| Add a feature | `CONTRIBUTING.md` + the matching `docs/<area>.md` |
40−| Per-area deep dives | `docs/frameworks/SKILLS.md`, `docs/frameworks/MEMORY.md`, `docs/frameworks/EVALS.md`, `docs/security/GUARDRAILS.md`, `docs/security/COMPLIANCE.md`, `docs/frameworks/CLOUD_AGENT.md`, `docs/frameworks/MCP-SERVER.md`, `docs/frameworks/A2A-SERVER.md`, `docs/architecture/AUTHZ_GUIDE.md`, `docs/architecture/RESILIENCE_GUIDE.md`, `docs/routing/AUTO-COMBO.md`, `docs/frameworks/WEBHOOKS.md`, `docs/routing/REASONING_REPLAY.md`, `docs/security/STEALTH_GUIDE.md`, `docs/ops/TUNNELS_GUIDE.md`, `docs/guides/ELECTRON_GUIDE.md`, `docs/reference/PROVIDER_REFERENCE.md` |
41−| Release flow | `docs/ops/RELEASE_CHECKLIST.md` |
42−
43−## 4. Local development access
44−
45−The dashboard is reachable at the operator's chosen URL/port (default `http://localhost:20128`). Credentials are operator-specific:
46−
47−- **Initial admin password** is read from the `INITIAL_PASSWORD` env var on first install (defaults to `CHANGEME` in `.env.example`; rotate immediately after first login).
48−- **Local VPS / shared dev environments**: ask the operator for the URL and current credentials — they live in their personal vault, NOT in this repo.
49−
50−> Any credential observed in a previous version of this file was a non-production demo value; treat it as compromised and do not reuse it.
3+- Treat `npm run test:coverage` as a required gate for PR work.
4+- The repository minimum is `60%` for statements, lines, functions, and branches.
5+- If a PR changes production code in `src/`, `open-sse/`, `electron/`, or `bin/`, it must include automated tests in the same PR.
6+- When reviewing or updating a PR, if the report shows missing tests or coverage below `60%`, do not stop after reporting the problem. Add or update tests in the PR first, rerun the coverage gate, and only then ask for confirmation.
7+- Prefer the smallest test layer that proves the behavior:
8+ - unit tests first
9+ - integration tests when multiple modules or DB state are involved
10+ - e2e only when the behavior is truly UI or workflow-dependent
11+- For bug issues, try to encode the reproduction as an automated test before or alongside the fix.
12+- In the final PR report, include:
13+ - the commands you ran
14+ - the changed test files
15+ - the final coverage result
5116
