القائمة
TermQ logging privacy rules. Load when writing or reviewing any code that logs data. Terminal output is user data — treat it as sensitive regardless of context.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
TermQ release procedures. Load when executing any release — stable, beta, or hotfix. Covers versioning, tagging, monitoring, and verification.
TermQ development context. Load at session start and when working on TermQ. Covers project structure, module layout, toolchain rules, worktree workflow, settings architecture, and debugging (TermQLogger categories, log streaming, TERMQ_DEBUG mode).
TermQ code quality gate. Load when running verification checks before committing. Defines the four checks that must all pass with zero errors.
TermQ commit, branch, and PR conventions. Load when creating commits, branches, or pull requests.
TermQ localization workflows. Load when performing any localization task — extracting strings, translating, validating, auditing, or syncing language files.
Sparkle auto-update system for TermQ. Load when working on release workflows, appcast generation, update signing, or debugging update failures. Covers the full update pipeline from signing through delivery.
| name | logging-rules |
| description | TermQ logging privacy rules. Load when writing or reviewing any code that logs data. Terminal output is user data — treat it as sensitive regardless of context. |
Terminal output is user data. It can contain passwords, API keys, tokens, and secrets.
TermQ is a terminal emulator. Every byte flowing through a pane could be sensitive. Treat it accordingly — across the entire app, not just the terminal rendering layer.
| Destination | When active | May contain terminal content? |
|---|---|---|
os.Logger (Apple Unified Logging) | Always | NO |
/tmp/termq-debug.log | TERMQ_DEBUG=1 only | Yes — explicit developer opt-in |
os.Logger writes to Apple Unified Logging, which is:
log stream on the machineA password typed into a terminal that lands in Unified Logging is a security incident.
Metadata only — nothing derived from terminal content:
%0)io Category RuleTermQLogger.io exists for terminal byte-stream debugging. It must always be gated behind fileLoggingEnabled:
// CORRECT — gated, only active when TERMQ_DEBUG=1
if TermQLogger.fileLoggingEnabled {
TermQLogger.io.debug("output pane=\(paneId) len=\(data.count) «\(preview)»")
}
// WRONG — reaches os.Logger unconditionally for all users
TermQLogger.io.debug("output pane=\(paneId) len=\(data.count) «\(preview)»")
fileLoggingEnabled is only true when TERMQ_DEBUG=1 is set.
Before calling any TermQLogger.* method, ask:
"Does the string I'm logging contain or derive from anything the user typed or any terminal output?"
Yes → gate it behind TermQLogger.fileLoggingEnabled
No → log freely at the appropriate level