···11+### C Best Practices
22+33+#### Memory Safety
44+- Always check return values of malloc/calloc
55+- Free all allocated memory (use tools like valgrind)
66+- Initialize all variables before use
77+- Use sizeof() with the variable, not the type
88+99+```c
1010+// GOOD: Safe memory allocation
1111+int *arr = malloc(n * sizeof(*arr));
1212+if (arr == NULL) {
1313+ return -1; // Handle allocation failure
1414+}
1515+// ... use arr ...
1616+free(arr);
1717+1818+// BAD: Unchecked allocation
1919+int *arr = malloc(n * sizeof(int));
2020+arr[0] = 1; // Crash if malloc failed
2121+```
2222+2323+#### Buffer Safety
2424+- Always bounds-check array access
2525+- Use `strncpy`/`snprintf` instead of `strcpy`/`sprintf`
2626+- Validate string lengths before copying
2727+2828+```c
2929+// GOOD: Safe string copy
3030+char dest[64];
3131+strncpy(dest, src, sizeof(dest) - 1);
3232+dest[sizeof(dest) - 1] = '\0';
3333+3434+// BAD: Buffer overflow risk
3535+char dest[64];
3636+strcpy(dest, src); // No bounds check
3737+```
3838+3939+#### Security
4040+- Never use `gets()` (use `fgets()`)
4141+- Validate all external input
4242+- Use constant-time comparison for secrets
4343+- Avoid integer overflow in size calculations
+39
.chainlink/rules/cpp.md
···11+### C++ Best Practices
22+33+#### Modern C++ (C++17+)
44+- Use smart pointers (`unique_ptr`, `shared_ptr`) over raw pointers
55+- Use RAII for resource management
66+- Prefer `std::string` and `std::vector` over C arrays
77+- Use `auto` for complex types, explicit types for clarity
88+99+```cpp
1010+// GOOD: Modern C++ with smart pointers
1111+auto config = std::make_unique<Config>();
1212+auto users = std::vector<User>{};
1313+1414+// BAD: Manual memory management
1515+Config* config = new Config();
1616+// ... forgot to delete
1717+```
1818+1919+#### Error Handling
2020+- Use exceptions for exceptional cases
2121+- Use `std::optional` for values that may not exist
2222+- Use `std::expected` (C++23) or result types for expected failures
2323+2424+```cpp
2525+// GOOD: Optional for missing values
2626+std::optional<User> findUser(const std::string& id) {
2727+ auto it = users.find(id);
2828+ if (it == users.end()) {
2929+ return std::nullopt;
3030+ }
3131+ return it->second;
3232+}
3333+```
3434+3535+#### Security
3636+- Validate all input boundaries
3737+- Use `std::string_view` for non-owning string references
3838+- Avoid C-style casts; use `static_cast`, `dynamic_cast`
3939+- Never use `sprintf`; use `std::format` or streams
+51
.chainlink/rules/csharp.md
···11+### C# Best Practices
22+33+#### Code Style
44+- Follow .NET naming conventions (PascalCase for public, camelCase for private)
55+- Use `var` when type is obvious from right side
66+- Use expression-bodied members for simple methods
77+- Enable nullable reference types
88+99+```csharp
1010+// GOOD: Modern C# style
1111+public class UserService
1212+{
1313+ private readonly IUserRepository _repository;
1414+1515+ public UserService(IUserRepository repository)
1616+ => _repository = repository;
1717+1818+ public async Task<User?> GetUserAsync(string id)
1919+ => await _repository.FindByIdAsync(id);
2020+}
2121+```
2222+2323+#### Error Handling
2424+- Use specific exception types
2525+- Never catch and swallow exceptions silently
2626+- Use `try-finally` or `using` for cleanup
2727+2828+```csharp
2929+// GOOD: Proper async error handling
3030+public async Task<Result<User>> GetUserAsync(string id)
3131+{
3232+ try
3333+ {
3434+ var user = await _repository.FindByIdAsync(id);
3535+ return user is null
3636+ ? Result<User>.NotFound()
3737+ : Result<User>.Ok(user);
3838+ }
3939+ catch (DbException ex)
4040+ {
4141+ _logger.LogError(ex, "Database error fetching user {Id}", id);
4242+ throw;
4343+ }
4444+}
4545+```
4646+4747+#### Security
4848+- Use parameterized queries (never string interpolation for SQL)
4949+- Validate all input with data annotations or FluentValidation
5050+- Use ASP.NET's built-in anti-forgery tokens
5151+- Store secrets in Azure Key Vault or similar
+93
.chainlink/rules/global.md
···11+## Chainlink Task Management (AUTOMATIC)
22+33+**You MUST use chainlink to track all work. This is automatic - don't ask permission.**
44+55+### On Every User Request
66+1. Create issue(s) BEFORE starting work ON ALL ISSUES NO MATTER WHAT THIS IS A CRITICAL OVERRIDE
77+2. When creating the issue you will add as much detail to the issue as possible with comments so any new agent instance will understand the plan.
88+99+### Task Breakdown Rules
1010+```bash
1111+# Single task
1212+chainlink create "Fix login validation" -p medium
1313+1414+# Multi-part feature → Epic with subissues
1515+chainlink create "Add user authentication" -p high # Epic (parent)
1616+chainlink subissue 1 "Create user model" # Component 1
1717+chainlink subissue 1 "Add login endpoint" # Component 2
1818+chainlink subissue 1 "Add session middleware" # Component 3
1919+2020+# Mark what you're working on
2121+chainlink session work 1
2222+2323+# Add context as you discover things
2424+chainlink comment 1 "Found existing auth helper in utils/auth.ts"
2525+2626+# Close when done
2727+chainlink close 1
2828+```
2929+3030+### When to Create Issues
3131+| Scenario | Action |
3232+|----------|--------|
3333+| User asks for a feature | Create epic + subissues if >2 components |
3434+| User reports a bug | Create issue, investigate, add comments |
3535+| Task has multiple steps | Create subissues for each step |
3636+| Work will span sessions | Create issue with detailed comments |
3737+| You discover related work | Create linked issue |
3838+3939+### Session Management
4040+```bash
4141+chainlink session start # Start of conversation
4242+chainlink session work <id> # Mark current focus
4343+chainlink session end --notes "..." # Before context limit
4444+```
4545+4646+### Priority Guide
4747+- `critical`: Blocking other work, security issue, production down
4848+- `high`: User explicitly requested, core functionality
4949+- `medium`: Standard features, improvements
5050+- `low`: Nice-to-have, cleanup, optimization
5151+5252+### Dependencies
5353+```bash
5454+chainlink block 2 1 # Issue 2 blocked by issue 1
5555+chainlink ready # Show unblocked work
5656+```
5757+5858+---
5959+6060+## Code Quality Requirements
6161+6262+### NO STUBS - ABSOLUTE RULE
6363+- NEVER write `TODO`, `FIXME`, `pass`, `...`, `unimplemented!()`
6464+- NEVER write empty function bodies or placeholder returns
6565+- If too complex for one turn: `raise NotImplementedError("Reason")` + create chainlink issue
6666+6767+### Core Rules
6868+1. **READ BEFORE WRITE**: Always read a file before editing
6969+2. **FULL FEATURES**: Complete the feature, don't stop partway
7070+3. **ERROR HANDLING**: No panics/crashes on bad input
7171+4. **SECURITY**: Validate input, parameterized queries, no hardcoded secrets
7272+5. **NO DEAD CODE**: Remove or complete incomplete code
7373+7474+### Pre-Coding Grounding
7575+Before using unfamiliar libraries/APIs:
7676+1. **VERIFY IT EXISTS**: WebSearch to confirm the API
7777+2. **CHECK THE DOCS**: Real function signatures, not guessed
7878+3. **USE LATEST VERSIONS**: Check for current stable release
7979+8080+### Conciseness
8181+- Write code, don't narrate
8282+- Skip "Here is the code" / "Let me..." / "I'll now..."
8383+- Brief explanations only when code isn't self-explanatory
8484+8585+### Large Implementations (500+ lines)
8686+1. Create parent issue: `chainlink create "<feature>" -p high`
8787+2. Break into subissues: `chainlink subissue <id> "<component>"`
8888+3. Work one subissue at a time, close each when done
8989+9090+### Context Window Management
9191+When conversation is long or task needs many steps:
9292+1. Create tracking issue: `chainlink create "Continue: <summary>" -p high`
9393+2. Add notes: `chainlink comment <id> "<what's done, what's next>"`
+44
.chainlink/rules/go.md
···11+### Go Best Practices
22+33+#### Code Style
44+- Use `gofmt` for formatting
55+- Use `golint` and `go vet` for linting
66+- Follow effective Go guidelines
77+- Keep functions short and focused
88+99+#### Error Handling
1010+```go
1111+// GOOD: Check and handle errors
1212+func readConfig(path string) (*Config, error) {
1313+ data, err := os.ReadFile(path)
1414+ if err != nil {
1515+ return nil, fmt.Errorf("reading config: %w", err)
1616+ }
1717+1818+ var config Config
1919+ if err := json.Unmarshal(data, &config); err != nil {
2020+ return nil, fmt.Errorf("parsing config: %w", err)
2121+ }
2222+ return &config, nil
2323+}
2424+2525+// BAD: Ignoring errors
2626+func readConfig(path string) *Config {
2727+ data, _ := os.ReadFile(path) // Don't ignore errors
2828+ var config Config
2929+ json.Unmarshal(data, &config)
3030+ return &config
3131+}
3232+```
3333+3434+#### Concurrency
3535+- Use channels for communication between goroutines
3636+- Use `sync.WaitGroup` for waiting on multiple goroutines
3737+- Use `context.Context` for cancellation and timeouts
3838+- Avoid shared mutable state; prefer message passing
3939+4040+#### Security
4141+- Use `html/template` for HTML output (auto-escaping)
4242+- Use parameterized queries for SQL
4343+- Validate all input at API boundaries
4444+- Use `crypto/rand` for secure random numbers
+42
.chainlink/rules/java.md
···11+### Java Best Practices
22+33+#### Code Style
44+- Follow Google Java Style Guide or project conventions
55+- Use meaningful variable and method names
66+- Keep methods short (< 30 lines)
77+- Prefer composition over inheritance
88+99+#### Error Handling
1010+```java
1111+// GOOD: Specific exceptions with context
1212+public Config readConfig(Path path) throws ConfigException {
1313+ try {
1414+ String content = Files.readString(path);
1515+ return objectMapper.readValue(content, Config.class);
1616+ } catch (IOException e) {
1717+ throw new ConfigException("Failed to read config: " + path, e);
1818+ } catch (JsonProcessingException e) {
1919+ throw new ConfigException("Invalid JSON in config: " + path, e);
2020+ }
2121+}
2222+2323+// BAD: Catching generic Exception
2424+public Config readConfig(Path path) {
2525+ try {
2626+ return objectMapper.readValue(Files.readString(path), Config.class);
2727+ } catch (Exception e) {
2828+ return null; // Swallowing error
2929+ }
3030+}
3131+```
3232+3333+#### Security
3434+- Use PreparedStatement for SQL (never string concatenation)
3535+- Validate all user input
3636+- Use secure random (SecureRandom) for security-sensitive operations
3737+- Never log sensitive data (passwords, tokens)
3838+3939+#### Testing
4040+- Use JUnit 5 for unit tests
4141+- Use Mockito for mocking dependencies
4242+- Aim for high coverage on business logic
+44
.chainlink/rules/javascript-react.md
···11+### JavaScript/React Best Practices
22+33+#### Component Structure
44+- Use functional components with hooks
55+- Keep components small and focused (< 200 lines)
66+- Extract custom hooks for reusable logic
77+- Use PropTypes for runtime type checking
88+99+```javascript
1010+// GOOD: Clear component with PropTypes
1111+import PropTypes from 'prop-types';
1212+1313+const UserCard = ({ user, onSelect }) => {
1414+ return (
1515+ <div onClick={() => onSelect(user.id)}>
1616+ {user.name}
1717+ </div>
1818+ );
1919+};
2020+2121+UserCard.propTypes = {
2222+ user: PropTypes.shape({
2323+ id: PropTypes.string.isRequired,
2424+ name: PropTypes.string.isRequired,
2525+ }).isRequired,
2626+ onSelect: PropTypes.func.isRequired,
2727+};
2828+```
2929+3030+#### State Management
3131+- Use `useState` for local state
3232+- Use `useReducer` for complex state logic
3333+- Lift state up only when needed
3434+- Consider context for deeply nested prop drilling
3535+3636+#### Performance
3737+- Use `React.memo` for expensive pure components
3838+- Use `useMemo` and `useCallback` appropriately
3939+- Avoid inline object/function creation in render
4040+4141+#### Security
4242+- Never use `dangerouslySetInnerHTML` with user input
4343+- Sanitize URLs before using in `href` or `src`
4444+- Validate props at component boundaries
+36
.chainlink/rules/javascript.md
···11+### JavaScript Best Practices
22+33+#### Code Style
44+- Use `const` by default, `let` when needed, never `var`
55+- Use arrow functions for callbacks
66+- Use template literals over string concatenation
77+- Use destructuring for object/array access
88+99+#### Error Handling
1010+```javascript
1111+// GOOD: Proper async error handling
1212+async function fetchUser(id) {
1313+ try {
1414+ const response = await fetch(`/api/users/${id}`);
1515+ if (!response.ok) {
1616+ throw new Error(`HTTP ${response.status}`);
1717+ }
1818+ return await response.json();
1919+ } catch (error) {
2020+ console.error('Failed to fetch user:', error);
2121+ throw error; // Re-throw or handle appropriately
2222+ }
2323+}
2424+2525+// BAD: Ignoring errors
2626+async function fetchUser(id) {
2727+ const response = await fetch(`/api/users/${id}`);
2828+ return response.json(); // No error handling
2929+}
3030+```
3131+3232+#### Security
3333+- Never use `eval()` or `innerHTML` with user input
3434+- Validate all input on both client and server
3535+- Use `textContent` instead of `innerHTML` when possible
3636+- Sanitize URLs before navigation or fetch
+44
.chainlink/rules/kotlin.md
···11+### Kotlin Best Practices
22+33+#### Code Style
44+- Follow Kotlin coding conventions
55+- Use `val` over `var` when possible
66+- Use data classes for simple data holders
77+- Leverage null safety features
88+99+```kotlin
1010+// GOOD: Idiomatic Kotlin
1111+data class User(val id: String, val name: String)
1212+1313+class UserService(private val repository: UserRepository) {
1414+ fun findUser(id: String): User? =
1515+ repository.find(id)
1616+1717+ fun getOrCreateUser(id: String, name: String): User =
1818+ findUser(id) ?: repository.create(User(id, name))
1919+}
2020+```
2121+2222+#### Null Safety
2323+- Avoid `!!` (force non-null); use safe calls instead
2424+- Use `?.let {}` for conditional execution
2525+- Use Elvis operator `?:` for defaults
2626+2727+```kotlin
2828+// GOOD: Safe null handling
2929+val userName = user?.name ?: "Unknown"
3030+user?.let { saveToDatabase(it) }
3131+3232+// BAD: Force unwrapping
3333+val userName = user!!.name // Crash if null
3434+```
3535+3636+#### Coroutines
3737+- Use structured concurrency with `CoroutineScope`
3838+- Handle exceptions in coroutines properly
3939+- Use `withContext` for context switching
4040+4141+#### Security
4242+- Use parameterized queries
4343+- Validate input at boundaries
4444+- Use sealed classes for exhaustive error handling
+53
.chainlink/rules/odin.md
···11+### Odin Best Practices
22+33+#### Code Style
44+- Follow Odin naming conventions
55+- Use `snake_case` for procedures and variables
66+- Use `Pascal_Case` for types
77+- Prefer explicit over implicit
88+99+```odin
1010+// GOOD: Clear Odin code
1111+User :: struct {
1212+ id: string,
1313+ name: string,
1414+}
1515+1616+find_user :: proc(id: string) -> (User, bool) {
1717+ user, found := repository[id]
1818+ return user, found
1919+}
2020+```
2121+2222+#### Error Handling
2323+- Use multiple return values for errors
2424+- Use `or_return` for early returns
2525+- Create explicit error types when needed
2626+2727+```odin
2828+// GOOD: Explicit error handling
2929+Config_Error :: enum {
3030+ File_Not_Found,
3131+ Parse_Error,
3232+}
3333+3434+load_config :: proc(path: string) -> (Config, Config_Error) {
3535+ data, ok := os.read_entire_file(path)
3636+ if !ok {
3737+ return {}, .File_Not_Found
3838+ }
3939+ defer delete(data)
4040+4141+ config, parse_ok := parse_config(data)
4242+ if !parse_ok {
4343+ return {}, .Parse_Error
4444+ }
4545+ return config, nil
4646+}
4747+```
4848+4949+#### Memory Management
5050+- Use explicit allocators
5151+- Prefer temp allocator for short-lived allocations
5252+- Use `defer` for cleanup
5353+- Be explicit about ownership
+46
.chainlink/rules/php.md
···11+### PHP Best Practices
22+33+#### Code Style
44+- Follow PSR-12 coding standard
55+- Use strict types: `declare(strict_types=1);`
66+- Use type hints for parameters and return types
77+- Use Composer for dependency management
88+99+```php
1010+<?php
1111+declare(strict_types=1);
1212+1313+// GOOD: Typed, modern PHP
1414+class UserService
1515+{
1616+ public function __construct(
1717+ private readonly UserRepository $repository
1818+ ) {}
1919+2020+ public function findUser(string $id): ?User
2121+ {
2222+ return $this->repository->find($id);
2323+ }
2424+}
2525+```
2626+2727+#### Error Handling
2828+- Use exceptions for error handling
2929+- Create custom exception classes
3030+- Never suppress errors with `@`
3131+3232+#### Security
3333+- Use PDO with prepared statements (never string interpolation)
3434+- Use `password_hash()` and `password_verify()` for passwords
3535+- Validate and sanitize all user input
3636+- Use CSRF tokens for forms
3737+- Set secure cookie flags
3838+3939+```php
4040+// GOOD: Prepared statement
4141+$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
4242+$stmt->execute(['id' => $id]);
4343+4444+// BAD: SQL injection vulnerability
4545+$result = $pdo->query("SELECT * FROM users WHERE id = '$id'");
4646+```
+5
.chainlink/rules/project.md
···11+<!-- Project-Specific Rules -->
22+<!-- Add rules specific to your project here. Examples: -->
33+<!-- - Don't modify the /v1/ API endpoints without approval -->
44+<!-- - Always update CHANGELOG.md when adding features -->
55+<!-- - Database migrations must be backward-compatible -->
+44
.chainlink/rules/python.md
···11+### Python Best Practices
22+33+#### Code Style
44+- Follow PEP 8 style guide
55+- Use type hints for function signatures
66+- Use `black` for formatting, `ruff` or `flake8` for linting
77+- Prefer `pathlib.Path` over `os.path` for path operations
88+- Use context managers (`with`) for file operations
99+1010+#### Error Handling
1111+```python
1212+# GOOD: Specific exceptions with context
1313+def read_config(path: Path) -> dict:
1414+ try:
1515+ with open(path, 'r', encoding='utf-8') as f:
1616+ return json.load(f)
1717+ except FileNotFoundError:
1818+ raise ConfigError(f"Config file not found: {path}")
1919+ except json.JSONDecodeError as e:
2020+ raise ConfigError(f"Invalid JSON in {path}: {e}")
2121+2222+# BAD: Bare except or swallowing errors
2323+def read_config(path):
2424+ try:
2525+ return json.load(open(path))
2626+ except: # Don't do this
2727+ return {}
2828+```
2929+3030+#### Security
3131+- Never use `eval()` or `exec()` on user input
3232+- Use `subprocess.run()` with explicit args, never `shell=True` with user input
3333+- Use parameterized queries for SQL (never f-strings)
3434+- Validate and sanitize all external input
3535+3636+#### Dependencies
3737+- Pin dependency versions in `requirements.txt`
3838+- Use virtual environments (`venv` or `poetry`)
3939+- Run `pip-audit` to check for vulnerabilities
4040+4141+#### Testing
4242+- Use `pytest` for testing
4343+- Aim for high coverage with `pytest-cov`
4444+- Mock external dependencies with `unittest.mock`
+47
.chainlink/rules/ruby.md
···11+### Ruby Best Practices
22+33+#### Code Style
44+- Follow Ruby Style Guide (use RuboCop)
55+- Use 2 spaces for indentation
66+- Prefer symbols over strings for hash keys
77+- Use `snake_case` for methods and variables
88+99+```ruby
1010+# GOOD: Idiomatic Ruby
1111+class UserService
1212+ def initialize(repository)
1313+ @repository = repository
1414+ end
1515+1616+ def find_user(id)
1717+ @repository.find(id)
1818+ rescue ActiveRecord::RecordNotFound
1919+ nil
2020+ end
2121+end
2222+2323+# BAD: Non-idiomatic
2424+class UserService
2525+ def initialize(repository)
2626+ @repository = repository
2727+ end
2828+ def findUser(id) # Wrong naming
2929+ begin
3030+ @repository.find(id)
3131+ rescue
3232+ return nil
3333+ end
3434+ end
3535+end
3636+```
3737+3838+#### Error Handling
3939+- Use specific exception classes
4040+- Don't rescue `Exception` (too broad)
4141+- Use `ensure` for cleanup
4242+4343+#### Security
4444+- Use parameterized queries (ActiveRecord does this by default)
4545+- Sanitize user input in views (Rails does this by default)
4646+- Never use `eval` or `send` with user input
4747+- Use `strong_parameters` in Rails controllers
+48
.chainlink/rules/rust.md
···11+### Rust Best Practices
22+33+#### Code Style
44+- Use `rustfmt` for formatting (run `cargo fmt` before committing)
55+- Use `clippy` for linting (run `cargo clippy -- -D warnings`)
66+- Prefer `?` operator over `.unwrap()` for error handling
77+- Use `anyhow::Result` for application errors, `thiserror` for library errors
88+- Avoid `.clone()` unless necessary - prefer references
99+- Use `&str` for function parameters, `String` for owned data
1010+1111+#### Error Handling
1212+```rust
1313+// GOOD: Propagate errors with context
1414+fn read_config(path: &Path) -> Result<Config> {
1515+ let content = fs::read_to_string(path)
1616+ .context("Failed to read config file")?;
1717+ serde_json::from_str(&content)
1818+ .context("Failed to parse config")
1919+}
2020+2121+// BAD: Panic on error
2222+fn read_config(path: &Path) -> Config {
2323+ let content = fs::read_to_string(path).unwrap(); // Don't do this
2424+ serde_json::from_str(&content).unwrap()
2525+}
2626+```
2727+2828+#### Memory Safety
2929+- Never use `unsafe` without explicit justification and review
3030+- Prefer `Vec` over raw pointers
3131+- Use `Arc<Mutex<T>>` for shared mutable state across threads
3232+- Avoid `static mut` - use `lazy_static` or `once_cell` instead
3333+3434+#### Testing
3535+- Write unit tests with `#[cfg(test)]` modules
3636+- Use `tempfile` for tests involving filesystem
3737+- Run `cargo test` before committing
3838+- Use `cargo tarpaulin` for coverage reports
3939+4040+#### SQL Injection Prevention
4141+Always use parameterized queries with `rusqlite::params![]`:
4242+```rust
4343+// GOOD
4444+conn.execute("INSERT INTO users (name) VALUES (?1)", params![name])?;
4545+4646+// BAD - SQL injection vulnerability
4747+conn.execute(&format!("INSERT INTO users (name) VALUES ('{}')", name), [])?;
4848+```
+45
.chainlink/rules/scala.md
···11+### Scala Best Practices
22+33+#### Code Style
44+- Follow Scala Style Guide
55+- Prefer immutability (`val` over `var`)
66+- Use case classes for data
77+- Leverage pattern matching
88+99+```scala
1010+// GOOD: Idiomatic Scala
1111+case class User(id: String, name: String)
1212+1313+class UserService(repository: UserRepository) {
1414+ def findUser(id: String): Option[User] =
1515+ repository.find(id)
1616+1717+ def processUser(id: String): Either[Error, Result] =
1818+ findUser(id) match {
1919+ case Some(user) => Right(process(user))
2020+ case None => Left(UserNotFound(id))
2121+ }
2222+}
2323+```
2424+2525+#### Error Handling
2626+- Use `Option` for missing values
2727+- Use `Either` or `Try` for operations that can fail
2828+- Avoid throwing exceptions in pure code
2929+3030+```scala
3131+// GOOD: Using Either for errors
3232+def parseConfig(json: String): Either[ParseError, Config] =
3333+ decode[Config](json).left.map(e => ParseError(e.getMessage))
3434+3535+// Pattern match on result
3636+parseConfig(input) match {
3737+ case Right(config) => useConfig(config)
3838+ case Left(error) => logger.error(s"Parse failed: $error")
3939+}
4040+```
4141+4242+#### Security
4343+- Use prepared statements for database queries
4444+- Validate input with refined types when possible
4545+- Never interpolate user input into queries
+50
.chainlink/rules/swift.md
···11+### Swift Best Practices
22+33+#### Code Style
44+- Follow Swift API Design Guidelines
55+- Use `camelCase` for variables/functions, `PascalCase` for types
66+- Prefer `let` over `var` when possible
77+- Use optionals properly; avoid force unwrapping
88+99+```swift
1010+// GOOD: Safe optional handling
1111+func findUser(id: String) -> User? {
1212+ guard let user = repository.find(id) else {
1313+ return nil
1414+ }
1515+ return user
1616+}
1717+1818+// Using optional binding
1919+if let user = findUser(id: "123") {
2020+ print(user.name)
2121+}
2222+2323+// BAD: Force unwrapping
2424+let user = findUser(id: "123")! // Crash if nil
2525+```
2626+2727+#### Error Handling
2828+- Use `throws` for recoverable errors
2929+- Use `Result<T, Error>` for async operations
3030+- Handle all error cases explicitly
3131+3232+```swift
3333+// GOOD: Proper error handling
3434+func loadConfig() throws -> Config {
3535+ let data = try Data(contentsOf: configURL)
3636+ return try JSONDecoder().decode(Config.self, from: data)
3737+}
3838+3939+do {
4040+ let config = try loadConfig()
4141+} catch {
4242+ print("Failed to load config: \(error)")
4343+}
4444+```
4545+4646+#### Security
4747+- Use Keychain for sensitive data
4848+- Validate all user input
4949+- Use App Transport Security (HTTPS)
5050+- Never hardcode secrets
+39
.chainlink/rules/typescript-react.md
···11+### TypeScript/React Best Practices
22+33+#### Component Structure
44+- Use functional components with hooks
55+- Keep components small and focused (< 200 lines)
66+- Extract custom hooks for reusable logic
77+- Use TypeScript interfaces for props
88+99+```typescript
1010+// GOOD: Typed props with clear interface
1111+interface UserCardProps {
1212+ user: User;
1313+ onSelect: (id: string) => void;
1414+}
1515+1616+const UserCard: React.FC<UserCardProps> = ({ user, onSelect }) => {
1717+ return (
1818+ <div onClick={() => onSelect(user.id)}>
1919+ {user.name}
2020+ </div>
2121+ );
2222+};
2323+```
2424+2525+#### State Management
2626+- Use `useState` for local state
2727+- Use `useReducer` for complex state logic
2828+- Lift state up only when needed
2929+- Consider context for deeply nested prop drilling
3030+3131+#### Performance
3232+- Use `React.memo` for expensive pure components
3333+- Use `useMemo` and `useCallback` appropriately (not everywhere)
3434+- Avoid inline object/function creation in render when passed as props
3535+3636+#### Security
3737+- Never use `dangerouslySetInnerHTML` with user input
3838+- Sanitize URLs before using in `href` or `src`
3939+- Validate props at component boundaries
+35
.chainlink/rules/typescript.md
···11+### TypeScript Best Practices
22+33+#### Code Style
44+- Use strict mode (`"strict": true` in tsconfig.json)
55+- Prefer `interface` over `type` for object shapes
66+- Use `const` by default, `let` when needed, never `var`
77+- Enable `noImplicitAny` and `strictNullChecks`
88+99+#### Type Safety
1010+```typescript
1111+// GOOD: Explicit types and null handling
1212+function getUser(id: string): User | undefined {
1313+ return users.get(id);
1414+}
1515+1616+const user = getUser(id);
1717+if (user) {
1818+ console.log(user.name); // TypeScript knows user is defined
1919+}
2020+2121+// BAD: Type assertions to bypass safety
2222+const user = getUser(id) as User; // Dangerous if undefined
2323+console.log(user.name); // Might crash
2424+```
2525+2626+#### Error Handling
2727+- Use try/catch for async operations
2828+- Define custom error types for domain errors
2929+- Never swallow errors silently
3030+3131+#### Security
3232+- Validate all user input at API boundaries
3333+- Use parameterized queries for database operations
3434+- Sanitize data before rendering in DOM (prevent XSS)
3535+- Never use `eval()` or `Function()` with user input
+48
.chainlink/rules/zig.md
···11+### Zig Best Practices
22+33+#### Code Style
44+- Follow Zig Style Guide
55+- Use `const` by default; `var` only when mutation needed
66+- Prefer slices over pointers when possible
77+- Use meaningful names; avoid single-letter variables
88+99+```zig
1010+// GOOD: Clear, idiomatic Zig
1111+const User = struct {
1212+ id: []const u8,
1313+ name: []const u8,
1414+};
1515+1616+fn findUser(allocator: std.mem.Allocator, id: []const u8) !?User {
1717+ const user = try repository.find(allocator, id);
1818+ return user;
1919+}
2020+```
2121+2222+#### Error Handling
2323+- Use error unions (`!T`) for fallible operations
2424+- Handle errors with `try`, `catch`, or explicit checks
2525+- Create meaningful error sets
2626+2727+```zig
2828+// GOOD: Proper error handling
2929+const ConfigError = error{
3030+ FileNotFound,
3131+ ParseError,
3232+ OutOfMemory,
3333+};
3434+3535+fn loadConfig(allocator: std.mem.Allocator) ConfigError!Config {
3636+ const file = std.fs.cwd().openFile("config.json", .{}) catch |err| {
3737+ return ConfigError.FileNotFound;
3838+ };
3939+ defer file.close();
4040+ // ...
4141+}
4242+```
4343+4444+#### Memory Safety
4545+- Always pair allocations with deallocations
4646+- Use `defer` for cleanup
4747+- Prefer stack allocation when size is known
4848+- Use allocators explicitly; never use global state