revealui-safety

---
name: revealui-safety
description: |
  RevealUI safety guardrails for any code task — editing, writing, creating, fixing,
  refactoring, changing, adding, updating, or removing files. Protects credentials,
  enforces import boundaries, ensures code quality, and verifies work before completion.
---

# RevealUI Safety

Follow these rules for ALL code changes in the RevealUI monorepo.

## Protected Files — Ask Before Editing

- `.env*` files (`.env`, `.env.local`, `.env.production`, etc.)
- Lock files: `pnpm-lock.yaml`, `package-lock.json`, `yarn.lock`
- Database schema files in `packages/db/src/schema/` — changes require migration planning

## Protected Paths — Never Edit

- `/mnt/c/`, `/mnt/e/` — Windows mounts (read-only)
- System/credential directories: `/etc/`, `~/.ssh/`, `~/.gnupg/`, `~/.aws/`

## Import Boundaries

All persistence goes through the single Drizzle/Neon client (`@revealui/db`). Do not introduce a second database client or a separate vector/auth SDK — vector data lives in pgvector on the same Neon database. (A customer-facing Supabase MCP adapter exists for connecting a customer's own Supabase project; that is not an internal store.)

## Code Quality

- Never use `any` — use `unknown` + type guards
- Never add `console.*` in production code — use `@revealui/utils` logger
- Never hardcode API keys, tokens, passwords, or secrets
- Use `crypto.randomInt()` for security-sensitive values, not `Math.random()`

## Static Analysis

- For security and architecture validation scripts, prefer AST-based analysis over regex when the rule depends on syntax or code shape
- Use regex only for heuristic inventory scans (for example obvious secret patterns), not as the source of truth for code-security conclusions

## After Every Edit

Run `npx biome check --write <file>` on each file you edit before moving on.

## Before Claiming Done

1. Run `pnpm gate:quick` and confirm no new errors
2. Review `git diff` for unintended changes
3. Ensure conventional commit format: `type(scope): description`
4. Git identity: commit as your own GitHub noreply address (`<ID>+<username>@users.noreply.github.com`)

## Known Limitation

These rules are advisory. Unlike Claude Code (which enforces via lifecycle hooks), Codex has no hook system. If working on sensitive files, explicitly invoke `$revealui-safety` to load these rules.

More agent context in RevealUIStudio/revealui

10 other files this repository gives its agents.