This document provides guidance for AI coding agents working with the LangChain.js codebase.
## Corridor security analysis
When Corridor's `analyzePlan` tool is available, create a plan and use the tool
Steady4 mentions in 2 weeks
No other project uses it yet
18k2mo agoReviewMountCreate a free account to mount
gitlink may be tracked anywhere, and neither the vendored reference clones nor
the security triage excised before publication may reappear in the index. Both
were driven red once to prove
18k41d agoReviewMountCreate a free account to mount
instructions
This file applies to `.github/` and inherits the repository-wide rules in `/AGENTS.md`.
## Security boundary
Every workflow, ownership, branch-enforcement, release, or repository-automation
change requires explicit security review
No other project uses it yet
18k41d agoReviewMountCreate a free account to mount
provided by the current stack or a small local implementation.
- Dependency changes require explicit security review.
- Update `docs-site/` when dashboard behavior, setup, or configuration changes for users.
## Failure mode
No other project uses it yet
18k41d agoReviewMountCreate a free account to mount
Changes to release, packaging, dependency-installation, credential, or repository-automation scripts require explicit security review.
## Implementation rules
- Preserve Linux, macOS, and Windows behavior. Do not add shell-specific assumptions
No other project uses it yet
18k41d agoReviewMountCreate a free account to mount
relevant to that adapter.
- Authentication, OAuth, token, credential, management API, and CORS changes are security-boundary changes.
## Tests and validation
- Place focused regression coverage near the existing tests
No other project uses it yet
18k41d agoReviewMountCreate a free account to mount
devlog/`.
- Superseded or alternative reasoning belongs in `decisions/`, not in the doc body.
- Unreleased security findings belong in scratch space and nowhere in this repository. The rule in
the root
No other project uses it yet
18k41d agoReviewMountCreate a free account to mount
tags, and
Node.js policy for every release line live in [VERSIONS.md](./VERSIONS.md); the
security policy in [SECURITY.md](./SECURITY.md).
The other branches of this repository:
| Branch | Role |
| -------- | -------------------------------------------------------------------------------------------------------- |
| `master` | 9.x next
18k8d agoReviewMountCreate a free account to mount
dependencies for straightforward behavior.
YAGNI never overrides explicit requirements or output, error, path, security,
compatibility, and data-safety contracts. If a deliberately limited solution has
a real ceiling, document
No other project uses it yet
18k53d agoReviewMountCreate a free account to mount
order (00-11) to get better learning:
1. **00-02**: Fundamentals (Introduction, Core Concepts, Security)
2. **03**: Getting Started with hands-on implementation
3. **04-05**: Practical implementation and advanced
No other project uses it yet
18k54d agoReviewMountCreate a free account to mount
Semgrep is a fast static analysis tool that searches code,
finds bugs, and enforces secure guardrails and coding standards.
## Architecture
Semgrep is divided in two major components
Steady4 mentions in 2 weeks
No other project uses it yet
17k2y agoReviewMountCreate a free account to mount
Apache APISIX — Agent Instructions
This file is read by automated agents (security scanners, code
analyzers, AI assistants) operating on this repository. It
points them at the human-authored references they
17k5y agoReviewMountCreate a free account to mount
Protocol: GitHub Restrictions
To maintain code quality and security standards, you are strictly prohibited from automatically opening or submitting Pull Requests (PRs) or GitHub Issues to any repository.
## Refuse
17k8d agoReviewMountCreate a free account to mount
templates in
`.github/ISSUE_TEMPLATE/`, not a `bug` label: `gh issue create --type Bug ...`.
- Security: never file a public issue or PR describing an undisclosed vulnerability, and never
reference an unpublished advisory
17k6mo agoReviewMountCreate a free account to mount
docker`, `dependencies`, `e2e`, `export`, `auth`, etc.
- Gitmoji examples: `✨` feature, `🐛` fix, `♻️` refactor, `⬆️` dependency upgrade, `🔒️` security
- Commits must be signed (`-S`) and signed-off (`--signoff`)
### Changelog
Update `CHANGELOG.md` under `[Unreleased]` with format
17k4mo agoReviewMountCreate a free account to mount
Resolved timestamp tracking for CDC
- `/components/resource_control/` - Resource control and quota management
- `/components/security/` - TLS and security utilities
- `/components/server/` - Server utilities and status server
- `/components/sst_importer/` - SST file import handling
- `/components/tikv_util/` - Common utilities
17k4mo agoReviewMountCreate a free account to mount