38 lines
1.9 KiB
Text
38 lines
1.9 KiB
Text
|
---
|
||
|
|
description: Files and directories agents must not edit, and should not use as context examples
|
||
|
|
alwaysApply: true
|
||
|
|
---
|
||
|
|
|
||
|
|
# No-go zones
|
||
|
|
|
||
|
|
Do not edit, refactor, or quote as context examples. If you think you need to change one of these, stop and ask.
|
||
|
|
|
||
|
|
## Generated / vendored
|
||
|
|
|
||
|
|
- `node_modules/` — generated dependency tree
|
||
|
|
- `.next/` — Next.js build output
|
||
|
|
- `.vercel/` — Vercel CLI local config + build cache
|
||
|
|
- `out/`, `build/` — build outputs if present
|
||
|
|
|
||
|
|
## Append-only / historical
|
||
|
|
|
||
|
|
- `components/Layout.js.backup` — legacy snapshot; delete with a real PR, never edit
|
||
|
|
- `scripts/add-*.js`, `scripts/fix-*.js`, `scripts/seed-*.js` — historical migration / seed jobs already executed. Write a NEW dated script (or a real migration) for further schema changes; never edit ones that already ran.
|
||
|
|
|
||
|
|
## Secrets / credentials
|
||
|
|
|
||
|
|
- `.env`, `.env.local`, `.env.development.local`, `.env.test.local`, `.env.production.local`
|
||
|
|
- Anything matching `.env*.local`
|
||
|
|
- Never commit `JWT_SECRET`, `POSTGRES_URL`, `RESEND_API_KEY`, `BLOB_READ_WRITE_TOKEN`, `GEMINI_API_KEY`, OpenAI/Anthropic keys.
|
||
|
|
|
||
|
|
## Local-only / per-developer
|
||
|
|
|
||
|
|
- `.code-review-graph/` — local MCP graph index (only if `user-code-review-graph` is installed)
|
||
|
|
- `.convoys/.metrics.jsonl` — per-developer convoy analytics (gitignored by default)
|
||
|
|
|
||
|
|
## Editing rules of thumb
|
||
|
|
|
||
|
|
- **Schema changes:** until a proper migration tool lands, document the change in a new dated script under `scripts/migrations/YYYY-MM-DD-<slug>.js` (folder TBD). Do NOT edit `scripts/setup-neon-db.js` in place — it's idempotent and meant for first-time setup only.
|
||
|
|
- **Auth refactors:** `lib/permission-middleware.js`, `pages/api/auth-utils.js`, `lib/auth-context.js`, `lib/admin-auth.js`, and `lib/use-auth.js` form a deliberately documented mess. Tighten them inside a single convoy; don't cherry-pick.
|
||
|
|
- **Card-import jobs:** `pages/api/cards/import-*.js` hit external APIs with rate limits. Don't run them ad-hoc against prod data; use staging.
|