agent/AGENTS.md

AGENTS.md

Project

This repository contains the SenlinAI project workbench MVP.

The product is a private-deployment, project-centered workbench for individual knowledge workers, team leads, and trusted internal users. It organizes project tasks, inbox items, Markdown notes, files, AI sessions, project-local tags, and lightweight task distribution.

Repository Layout

• backend: Go Gin + Gorm + PostgreSQL API.
• apps/web: Responsive Svelte + TypeScript web client.
• apps/desktop: Tauri desktop shell for the web client.
• infra: Local development infrastructure such as Docker Compose.
• docs/superpowers/specs: Product and technical specs.
• docs/superpowers/plans: Implementation plans.

Backend Rules

• Use Go, Gin, Gorm, and PostgreSQL.
• Keep backend modules focused under backend/internal.
• Use module path senlinai-agent/backend.
• Keep all server-local file path construction inside the file service.
• Do not let HTTP handlers construct storage paths directly.
• Keep project tags scoped to a project; do not introduce global tags in MVP.
• Keep task sharing conservative: assignees see the task and only explicitly shared linked objects.
• AI must not create official objects without user confirmation.
• AI calls must record provider, key type, action, status, and errors.
• Auth session tokens must be signed, expiring bearer tokens; do not accept forgeable user:<id> strings.
• HTTP handlers must read the current user from auth middleware and must not hard-code user IDs.
• Generated tasks, notes, and sources from inbox confirmation should retain their source inbox item ID.
• Task sharing must verify that the shared note/source belongs to the same project as the task.
• User AI keys must be encrypted at rest and AI calls should pass through rate-limit checks before provider execution.

Frontend Rules

• Use Svelte only for the frontend. Do not add React dependencies or React components.
• Build the web app desktop-first, while keeping mobile browser layouts usable.
• Keep feature code under apps/web/src/features.
• The login screen must let the user enter the server IP address or domain name.
• Use browser-style tabs for page-level workspace state.
• Save editor and AI input drafts separately from tab state.
• Use Markdown for MVP note editing.

Tauri Rules

• Tauri wraps the web client.
• MVP desktop features are login persistence, file drag-and-drop upload, notifications, and global shortcut quick capture.
• Do not add offline editing, local-first sync, background clipboard monitoring, or file-system indexing in MVP.

MVP Scope Guardrails

Do not add these unless a later approved spec says so:

• Real-time instant messaging.
• Project-level member roles.
• Anonymous public task sharing.
• Autonomous Agent execution.
• Semantic or vector search.
• Native mobile apps.
• Browser extension, email, IM, or third-party capture integrations.

Verification

• Backend changes should run go test ./... from backend.
• PostgreSQL integration checks should read a live test database URL from DATABASE_URL; do not commit real credentials.
• Web changes should run tests and build from apps/web.
• Tauri changes should build the web app first, then run the Tauri verification command from apps/desktop.
• Each implementation task should end with a focused commit.