Guidance for AI agents (and humans) working in tono-web.
tono-web is a TypeScript/JS app in the Console Labs / Mochi product line. Package manager: pnpm.
- Install:
pnpm install --frozen-lockfile - build:
pnpm build - dev:
pnpm dev - lint:
pnpm lint - start:
pnpm start
- Secrets come from env (
envmodule /process.env), NEVER hardcoded. Discord client/user/role IDs in source are public snowflakes, not secrets. - Follow the existing lint/format config; feature branches off the default branch.
- gitleaks: no leaks found.
- CI (
.github/workflows/security.yml) runs gitleaks (with.gitleaks.tomlallowlist) +pnpm audit --audit-level=highon PRs. - Dependency audit:
pnpm audit --audit-level=high; Dependabot enabled. Bump deliberately.