Skip to content

AGENTS.md

Latest commit

 

History

History
51 lines (37 loc) · 1.84 KB

AGENTS.md

File metadata and controls

51 lines (37 loc) · 1.84 KB

bin/ — Agent Guidelines

Scope: shell CLI and operational scripts under bin/.

Focus areas

  • CLI entrypoint (baudbot) and runtime helpers
  • deploy/update/rollback flows
  • security audit and firewall scripts
  • install/uninstall operational scripts
  • CI infrastructure (bin/ci/)
  • JS tooling: broker-register.mjs, scan-extensions.mjs (and their tests)
  • systemd unit files: baudbot.service, baudbot-firewall.service

Rules

  • Keep CLIs thin; move reusable logic into bin/lib/*.sh.
  • Reuse shared helpers (shell-common.sh, paths-common.sh, release-common.sh, etc.) instead of duplicating constants or logging/error patterns.
  • Prefer portable shell patterns; distro-specific branches are acceptable when reliability improves.
  • Any security-relevant shell change must include/adjust tests.
  • Never call node, npm, etc. by bare name in scripts that run as root. The embedded runtime is not on root's PATH. Use runtime-node.sh helpers (bb_resolve_runtime_node_bin, bb_resolve_runtime_node_bin_dir) to resolve the full path first.

Critical files

Treat as security-critical:

  • baudbot-safe-bash — runtime command-blocking wrapper
  • harden-permissions.sh — filesystem permission lockdown
  • setup-firewall.sh — network egress lockdown
  • security-audit.sh — security posture audit
  • scan-extensions.mjs — static analysis scanner for extensions
  • redact-logs.sh — secret redaction from session logs

Notes

  • Shared helpers in bin/lib/ have co-located test files (e.g. deploy-common.test.sh, json-common.test.sh). Update tests when changing helpers.
  • For JS files in bin/, also run npm run lint:js and npm run test:js.

Validation

Run before finishing shell work:

npm run lint:shell
npm run test:shell

For security-sensitive updates, also run:

bin/security-audit.sh --deep