Skip to content

CLAUDE.md

Latest commit

 

History

History
25 lines (16 loc) · 1.2 KB

CLAUDE.md

File metadata and controls

25 lines (16 loc) · 1.2 KB
Raw

CLAUDE.md

Guidance for AI agents (and humans) working in mochi-web.

What this is

mochi-web is a TypeScript/JS app in the Console Labs / Mochi product line. Package manager: pnpm.

Commands

  • Install: pnpm install --frozen-lockfile
  • build: pnpm build
  • dev: pnpm dev
  • start: pnpm start

Conventions

  • Secrets come from env (env module / process.env), NEVER hardcoded. Discord client/user/role IDs in source are public snowflakes, not secrets.
  • Follow the existing lint/format config; feature branches off the default branch.

Security / quality (consolidation hardening pass, 2026-06-25, lighter adoption)

  • gitleaks: 1 raw hit(s). Reviewed: the discord-client-id hits are public Discord snowflake IDs (user/role/guild IDs, not secrets), and the api-key hits are env-sourced keys / default IDs, not committed credentials. (1 private-key). Allowlisted (test paths + snowflake numerics) in .gitleaks.toml; verified no real credential is hardcoded (keys read from env).
  • CI (.github/workflows/security.yml) runs gitleaks (with .gitleaks.toml allowlist) + pnpm audit --audit-level=high on PRs.
  • Dependency audit: pnpm audit --audit-level=high; Dependabot enabled. Bump deliberately.