Files
tailscale-custom/.github/copilot-instructions.md
huanld 2fb067ecbf
checklocks / checklocks (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
natlab-integrationtest / natlab-integrationtest (push) Has been cancelled
CI / gomod-cache (push) Has been cancelled
CI / race-root-integration (1/4) (push) Has been cancelled
CI / race-root-integration (2/4) (push) Has been cancelled
CI / race-root-integration (3/4) (push) Has been cancelled
CI / race-root-integration (4/4) (push) Has been cancelled
CI / test (-race, amd64, 1/3) (push) Has been cancelled
CI / test (-race, amd64, 2/3) (push) Has been cancelled
CI / test (-race, amd64, 3/3) (push) Has been cancelled
CI / test (386) (push) Has been cancelled
CI / test (amd64) (push) Has been cancelled
CI / Windows (benchmarks) (push) Has been cancelled
CI / Windows (1/2) (push) Has been cancelled
CI / Windows (2/2) (push) Has been cancelled
CI / macos (push) Has been cancelled
CI / privileged (push) Has been cancelled
CI / vm (push) Has been cancelled
CI / cross (386, linux) (push) Has been cancelled
CI / cross (amd64, darwin) (push) Has been cancelled
CI / cross (amd64, freebsd) (push) Has been cancelled
CI / cross (amd64, openbsd) (push) Has been cancelled
CI / cross (amd64, windows) (push) Has been cancelled
CI / cross (arm, 5, linux) (push) Has been cancelled
CI / cross (arm, 7, linux) (push) Has been cancelled
CI / cross (arm64, darwin) (push) Has been cancelled
CI / cross (arm64, linux) (push) Has been cancelled
CI / cross (arm64, windows) (push) Has been cancelled
CI / cross (loong64, linux) (push) Has been cancelled
CI / ios (push) Has been cancelled
CI / crossmin (amd64, illumos) (push) Has been cancelled
CI / crossmin (amd64, plan9) (push) Has been cancelled
CI / crossmin (amd64, solaris) (push) Has been cancelled
CI / crossmin (ppc64, aix) (push) Has been cancelled
CI / android (push) Has been cancelled
CI / wasm (push) Has been cancelled
CI / tailscale_go (push) Has been cancelled
CI / fuzz (push) Has been cancelled
CI / depaware (push) Has been cancelled
CI / go_generate (push) Has been cancelled
CI / make_tidy (push) Has been cancelled
CI / licenses (push) Has been cancelled
CI / staticcheck (macOS) (push) Has been cancelled
CI / staticcheck (Linux) (push) Has been cancelled
CI / staticcheck (Windows) (push) Has been cancelled
CI / staticcheck (Portable (1/4)) (push) Has been cancelled
CI / staticcheck (Portable (2/4)) (push) Has been cancelled
CI / staticcheck (Portable (3/4)) (push) Has been cancelled
CI / staticcheck (Portable (4/4)) (push) Has been cancelled
CI / notify_slack (push) Has been cancelled
CI / merge_blocker (push) Has been cancelled
CI / check_mergeability_strict (push) Has been cancelled
CI / check_mergeability (push) Has been cancelled
Dockerfile build / deploy (push) Has been cancelled
test installer.sh / test (curl, alpine:3.21) (push) Has been cancelled
test installer.sh / test (curl, alpine:edge) (push) Has been cancelled
test installer.sh / test (curl, alpine:latest) (push) Has been cancelled
test installer.sh / test (curl, amazonlinux:latest) (push) Has been cancelled
test installer.sh / test (curl, archlinux:latest) (push) Has been cancelled
test installer.sh / test (curl, debian:oldstable-slim) (push) Has been cancelled
test installer.sh / test (curl, debian:sid-slim) (push) Has been cancelled
test installer.sh / test (curl, debian:stable-slim, 1.80.0) (push) Has been cancelled
test installer.sh / test (curl, debian:testing-slim) (push) Has been cancelled
test installer.sh / test (curl, elementary/docker:stable) (push) Has been cancelled
test installer.sh / test (curl, elementary/docker:unstable) (push) Has been cancelled
test installer.sh / test (curl, fedora:latest, 1.80.0) (push) Has been cancelled
test installer.sh / test (curl, kalilinux/kali-dev) (push) Has been cancelled
test installer.sh / test (curl, kalilinux/kali-rolling) (push) Has been cancelled
test installer.sh / test (curl, opensuse/leap:latest) (push) Has been cancelled
test installer.sh / test (curl, opensuse/tumbleweed:latest) (push) Has been cancelled
test installer.sh / test (curl, oraclelinux:8) (push) Has been cancelled
test installer.sh / test (curl, oraclelinux:9) (push) Has been cancelled
test installer.sh / test (curl, parrotsec/core:latest) (push) Has been cancelled
test installer.sh / test (curl, rockylinux:8.7) (push) Has been cancelled
test installer.sh / test (curl, rockylinux:9) (push) Has been cancelled
test installer.sh / test (curl, ubuntu:20.04) (push) Has been cancelled
test installer.sh / test (curl, ubuntu:22.04) (push) Has been cancelled
test installer.sh / test (curl, ubuntu:24.04, 1.80.0) (push) Has been cancelled
test installer.sh / test (wget, debian:oldstable-slim) (push) Has been cancelled
test installer.sh / test (wget, debian:sid-slim) (push) Has been cancelled
update-flake / update-flake (push) Has been cancelled
tailscale.com/cmd/vet / vet (push) Has been cancelled
test installer.sh / notify-slack (push) Has been cancelled
feat: security hardening, production roadmap, admin panel v1
Client security fixes (cmd/tailscale-tray/main.go):
- SSRF protection in Add Server dialog (validateControlURL): reject
  private/loopback/link-local/cloud-metadata IPs via DNS resolution
- RCE gate on AuthURL/BrowseToURL exec paths (validateAuthURL)
- Sanitized URL logging (sanitizeURLForLog drops query auth tokens)
- Error handling on exec.Command with user-facing showError()

Admin panel security (web-admin):
- Bcrypt password hashing (replaces SHA256)
- Rate limiting: 5 failed logins → 15-min lockout
- Session + login attempt cleanup goroutine (hourly)
- url.QueryEscape / encodeURIComponent for all API params
- Fail-hard startup when no TLS and non-loopback bind
- ADMIN_PASSWORD required (no default), password min 12 chars
- Username regex whitelist

Installer hardening (Setup.wxs):
- util:PermissionEx restricts SCM access: only Administrators +
  SYSTEM can start/stop/reconfigure service. Authenticated Users
  limited to QueryStatus/QueryConfig/Interrogate
- Vital="yes" on ServiceInstall

Docs & roadmap:
- PRODUCTION_ROADMAP.md: 5-milestone plan (security + features +
  distribution + ops) with granular tasks, effort, done-when
- CLIENT_SECURITY_AUDIT.md, SECURITY_FIXES.md, DEPLOYMENT.md
- AI assistant rules (.cursorrules, .antigravityrules, etc.)

Build & distribution:
- build-msi.ps1, deploy-and-sign.ps1, sign-release.ps1
- redeploy.ps1, tray-deploy.ps1, test-msi.ps1
- installer/msi/ alternative WXS setup
- Restored .github/workflows/ removed in mirror cleanup

.gitignore hardened: *.pfx, *.p12, *.key, *.pem, .env*
2026-04-22 15:18:11 +07:00

6.3 KiB

Antigravity Agent Kit — Instructions for GitHub Copilot

This file teaches Copilot how to use the .agent/ toolkit installed in this workspace.


What is .agent/?

This workspace contains an AI capability expansion toolkit at .agent/. It provides:

  • Agents (.agent/agents/*.md) — Specialist AI personas (frontend, backend, security, etc.)
  • Skills (.agent/skills/*/SKILL.md) — Domain-specific knowledge modules
  • Workflows (.agent/workflows/*.md) — Step-by-step procedures triggered by slash commands

Read .agent/ARCHITECTURE.md first to understand the full system map.


Agent Routing Protocol

Before writing code or making design decisions:

  1. Identify the domain of the user's request (Frontend, Backend, Security, Database, etc.)
  2. Select the matching agent from .agent/agents/
  3. Read that agent's .md file to understand its rules, persona, and linked skills
  4. Load linked skills listed in the agent file's frontmatter (skills: field)
  5. Apply the agent's rules when generating your response

Agent Selection Guide

Domain Agent File Key Skills
Web UI/UX frontend-specialist.md frontend-design, react-best-practices
API/Backend backend-specialist.md api-patterns, nodejs-best-practices
Database database-architect.md database-design
Mobile mobile-developer.md mobile-design
Security security-auditor.md vulnerability-scanner
Testing test-engineer.md testing-patterns, webapp-testing
Debugging debugger.md systematic-debugging
Planning project-planner.md brainstorming, plan-writing
Multi-domain orchestrator.md parallel-agents

Skill Loading Protocol

Skills are modular knowledge packages. To use a skill:

  1. Read SKILL.md inside the skill folder (e.g., .agent/skills/clean-code/SKILL.md)
  2. Only read the sections relevant to the current task (selective reading)
  3. If the skill has a scripts/ folder, those scripts can be executed for validation

Skill Structure

.agent/skills/{skill-name}/
├── SKILL.md           # Main instructions (REQUIRED — read this first)
├── scripts/           # Runnable validation scripts (optional)
├── references/        # Templates and docs (optional)
└── assets/            # Images, resources (optional)

Global Mandatory Skill

clean-code applies to ALL code. Always follow .agent/skills/clean-code/SKILL.md.


Workflow Conventions

Workflow files in .agent/workflows/*.md are triggered by slash commands (e.g., /debug, /deploy).

Special Annotations

When reading workflow files, understand these Antigravity-specific markers:

Marker Meaning
$ARGUMENTS Placeholder for user-provided arguments after the slash command
// turbo The NEXT step can be auto-executed without user confirmation
// turbo-all ALL subsequent steps in this section can be auto-executed

Available Workflows

Command File Purpose
/brainstorm brainstorm.md Socratic discovery
/create create.md Create new features
/debug debug.md Systematic debugging
/deploy deploy.md Production deployment
/enhance enhance.md Improve existing code
/ins-develop ins-develop.md INS Module development lifecycle
/orchestrate orchestrate.md Multi-agent coordination
/plan plan.md Task breakdown
/preview preview.md Preview changes
/status status.md Check project status
/test test.md Run tests
/ui-ux-pro-max ui-ux-pro-max.md UI design with 50+ styles

Rules Priority

When rules conflict, apply this priority:

  1. P0 — This instructions file + GEMINI.md rules
  2. P1 — Agent-specific rules (from .agent/agents/*.md)
  3. P2 — Skill-specific rules (from .agent/skills/*/SKILL.md)

Code Standards

  • Follow clean-code skill for all code
  • Use English for code, comments, and variable names
  • Respond in the user's language for explanations
  • Before modifying files, check for dependencies and update all affected files together

Important Paths

.agent/
├── ARCHITECTURE.md     # System overview — READ THIS FIRST
├── agents/             # 20 specialist agent definitions
├── skills/             # 38 knowledge modules
├── workflows/          # 16 slash command procedures
├── rules/              # IDE-specific instruction files
└── scripts/            # Master validation scripts

🛡️ Auto-Protection Rules (Always Active)

These rules are always enforced. No configuration needed.

Forbidden Directories

NEVER read or explore these directories — they waste context and provide no useful information:

node_modules/, .git/, dist/, build/, out/, bin/, obj/, packages/, .vs/, .idea/, __pycache__/, .next/, .nuxt/, .turbo/, vendor/, target/, coverage/

Instead: use package.json or *.csproj for dependency info. Use git commands for version control. Read source files, not build outputs.

Sensitive Files

Always ask the user before reading: .env, .env.*, *.key, *.pem, *.crt, *secret*, *credential*, appsettings.*.json, Web.config, launchSettings.json, *.pfx, *.p12

When approved: never echo passwords or API keys in responses. Replace with [REDACTED].

Context Efficiency

  • Search for specific content before reading entire files
  • Don't re-read files already seen in the conversation
  • For large files, read focused ranges (50-100 lines) instead of all at once
  • Use package.json or *.csproj/*.sln instead of exploring dependency directories

Naming Conventions

  • C# source files: PascalCase (UserService.cs)
  • JS/TS source files: kebab-case (user-service.ts)
  • Components: PascalCase (UserProfile.tsx, NavMenu.razor)
  • Tests (JS): {name}.test.{ext} | Tests (C#): {Name}Tests.cs
  • KEY: Always match the project's existing naming convention

Communication Style

Adapt based on user's expertise level. Default: Senior (code-first, minimal explanation). If user asks basic questions, shift to teaching mode. If user gives terse instructions, respond with pure code.