Skip to content

DEVASIGN.md

Latest commit

 

History

History
34 lines (31 loc) · 1.96 KB

DEVASIGN.md

File metadata and controls

34 lines (31 loc) · 1.96 KB
Raw

DEVASIGN.md

Conventions for this repository, read by DevAsign's own review agent. Each rule is a single checkable sentence. Newly introduced violations are flagged as nits — they don't block the merge. See README.md for how this file is used and scoped.

Backend (backend/)

  • Imports use explicit .js extensions on relative paths (TypeScript NodeNext ESM).
  • All Claude / LLM calls go through complete() in backend/src/llm.ts; pass cacheSystem: true when the system prompt is static. The documented exceptions are calls complete() can't express: PDF/image reads that need a document/ image content block (summarizeLinearFile, extractGuidanceFromPdf) and non-Anthropic provider calls (summarizeVideo, which uses Gemini) — these call the SDK/provider directly.
  • GitHub REST calls go through the gh() helper in backend/src/github/app.ts; the documented exceptions are raw blob reads via installationToken, the OAuth user-token identity calls (/user, /user/emails) in backend/src/github/oauth.ts (which need the user's OAuth token rather than an installation token), and the App-JWT /app/installations calls — minting installation tokens, listing installs, and uninstallApp's install delete — which need the App JWT (an installation token can't delete or enumerate installations).
  • Persistence goes through the db helper (db.insert/update/find/filter); do not write raw SQL in feature code.
  • A review finding only blocks a merge when its severity is blocker; advisory findings use warn or nit.
  • Always read, always write tests for all the changes made.

Frontend (frontend/)

  • The browser talks to the backend only through the typed client in frontend/src/api.ts — no ad-hoc fetch to API routes from components.
  • Styling uses the shared design tokens in frontend/src/styles.css (CSS variables like --accent, --fg-dim), not hard-coded hex values.