| name | revealui-safety |
| description | RevealUI safety guardrails for any code task — editing, writing, creating, fixing,
refactoring, changing, adding, updating, or removing files. Protects credentials,
enforces import boundaries, ensures code quality, and verifies work before completion.
|
RevealUI Safety
Follow these rules for ALL code changes in the RevealUI monorepo.
Protected Files — Ask Before Editing
.env* files (.env, .env.local, .env.production, etc.)- Lock files:
pnpm-lock.yaml, package-lock.json, yarn.lock
- Database schema files in
packages/db/src/schema/ — changes require migration planning
Protected Paths — Never Edit
/mnt/c/, /mnt/e/ — Windows mounts (read-only)- System/credential directories:
/etc/, ~/.ssh/, ~/.gnupg/, ~/.aws/
Import Boundaries
All persistence goes through the single Drizzle/Neon client (@revealui/db). Do not introduce a second database client or a separate vector/auth SDK — vector data lives in pgvector on the same Neon database. (A customer-facing Supabase MCP adapter exists for connecting a customer's own Supabase project; that is not an internal store.)
Code Quality
- Never use
any — use unknown + type guards
- Never add
console.* in production code — use @revealui/utils logger
- Never hardcode API keys, tokens, passwords, or secrets
- Use
crypto.randomInt() for security-sensitive values, not Math.random()
Static Analysis
- For security and architecture validation scripts, prefer AST-based analysis over regex when the rule depends on syntax or code shape
- Use regex only for heuristic inventory scans (for example obvious secret patterns), not as the source of truth for code-security conclusions
After Every Edit
Run npx biome check --write <file> on each file you edit before moving on.
Before Claiming Done
- Run
pnpm gate:quick and confirm no new errors
- Review
git diff for unintended changes
- Ensure conventional commit format:
type(scope): description
- Git identity: commit as your own GitHub noreply address (
<ID>+<username>@users.noreply.github.com)
Known Limitation
These rules are advisory. Unlike Claude Code (which enforces via lifecycle hooks), Codex has no hook system. If working on sensitive files, explicitly invoke $revealui-safety to load these rules.
