github.com/AtalayaLabs/OxiCloud (link)

commit signals (476)

source signals (5)

• CLAUDE.mdvia claude-code

  @AGENTS.md
  

• .claudeignorevia claude-code

  # .claudeignore
  node_modules/
  target/
  coverage/
  storage/
  
  # Secrets
  .env
  .env.local
  .env.production
  .jwt_secret
  *.pem
  *.key
  secrets.json
  
  # Logs
  *.log
  logs/
  
  
  # scm
  .git/
  
  # IDE
  .vscode/
  .idea/
  *.swp
  *.swo
  

• AGENTS.mdvia agents-md

  # AGENTS.md
  
  This file provides guidance to coding agents (Claude Code, Codex, Cursor, Aider, …) working with this repository. Claude Code reads it via `@AGENTS.md` in `CLAUDE.md`.
  
  # Purpose — what OxiCloud is, and what it is not
  
  Read this before designing anything. Most "should we…" questions are answered by
  the scale target rather than by taste.
  
  - **Open source, and it stays that way.** MIT (`LICENSE`). This is a constraint on
    what you may add, not a footnote: dependencies must be license-compa

• frontend/AGENTS.mdvia agents-md

  # AGENTS.md — Frontend
  
  Complements the repo-root `/AGENTS.md`. Not shipped (adapter-static
  copies only `frontend/static/`).
  
  ## localStorage keys
  
  Prefix `oxi-`, kebab-case separators. Example: `oxi-view-mode`.
  Enforced by `$lib/utils/localStoragePrefs::wipeAppKeys()` which sweeps
  every `oxi-*` key on user-account switches — any other prefix leaks the
  previous user's state into the new one.
  
  ## Logging — `loglevel` with `oxi:*` namespaces
  
  **Never use bare `console.debug/info/warn/error` in `$lib` or

• src/AGENTS.mdvia agents-md

  # src/AGENTS.md — backend-only notes
  
  Non-obvious rules that trip up new code. Terse on purpose.
  
  ## Auth policy
  
  - **OIDC is the master identity provider.** Whenever `AuthApplicationService::oidc_enabled()` returns true, magic-link login MUST be off — `is_magic_link_login_allowed()` returns false regardless of `OXICLOUD_AUTH_METHODS`. Rationale: OIDC may enforce 2FA / step-up; a mailbox-possession bypass would silently sidestep it.
  - **Password / magic-link handlers gate via `is_password_login_allowed(

ignorefile signals (1)