Skip to content

CLAUDE.md

Latest commit

 

History

History
29 lines (20 loc) · 2.66 KB

CLAUDE.md

File metadata and controls

29 lines (20 loc) · 2.66 KB
Raw

Project Rules — theblueprintcode/engine

NestJS + Fastify + Drizzle ORM (Postgres, multi-tenant schema-per-tenant) backend.

Always-on modes

  • Caveman (full): terse chat/status responses. Drop articles/filler/pleasantries, keep all technical substance, code, exact error strings. Does not apply to generated docs, commits, PRs, comments, memory files. Off only if user says "stop caveman" / "normal mode".
  • Ponytail (full): laziest solution that actually works. Climb the ladder before writing code — YAGNI check, reuse existing helper/pattern, stdlib, native platform feature, existing dependency, one-liner, only then custom code. No speculative abstractions, no boilerplate "for later". Deliberate corner-cuts get a ponytail: comment naming the ceiling. Off only if user says "stop ponytail" / "normal mode".

Skills relevant to this repo

Backend-focused — reach for these over ad-hoc grep/read when the task matches:

  • code-review — review diff/PR/branch for correctness bugs + reuse/simplification findings.
  • simplify — apply reuse/simplification/efficiency cleanups to changed code (no bug-hunting).
  • security-review — security-focused review pass (this repo does multi-tenant auth/API-key/RBAC — use before merging anything touching src/auth, src/common/guards, src/tenant).
  • run — launch/start the app to verify a change works end-to-end, not just via tests.
  • fewer-permission-prompts — scan transcripts, add allowlist to .claude/settings.json to cut prompt noise.
  • caveman:caveman-commit — terse commit message generation.
  • caveman:caveman-review — one-line-per-finding code review in caveman style.
  • ponytail:ponytail-review — over-engineering-only review (what to delete/simplify).
  • ponytail:ponytail-audit — whole-repo over-engineering audit.

Not relevant here (no Cloudflare/Vercel/video/design work in this repo): the cloudflare*, vercel:*, hyperframes*, media-use, video-use, ui-ux-pro-max:*, dashi-ppt families.

Known trouble spots (see prior review)

  • src/tenant/tenant.interceptor.ts + src/db/database.service.ts: tenant schema resolution takes raw client input (x-tenant-id header / API-key token) with no validation before it's used to build Postgres connection options and spawn per-schema pools. Needs allowlisting.
  • src/auth/strategies/api-key.strategy.ts: guard (ApiKeyGuard/UniversalAuthGuard) currently unused by any controller. When wired up, note Nest runs Guards before Interceptors — TenantInterceptor (global) won't have set the ALS schema yet when the strategy's validate() runs, so tenant context will be missing. Fix ordering before using these guards on a route.