Paste-ready agent rules
Encode Deno permission, dependency, verification, and destructive-action boundaries in repository instructions
Adapt this block to the repository before adding it to AGENTS.md:
## Deno workflow
- Read deno.json/deno.jsonc, deno.lock, package.json, and CI before changing commands.
- Reuse existing imports and tasks. Do not invent configuration keys.
- Add packages with the repository's Deno CLI workflow; keep one reviewed lockfile diff.
- Grant only scoped --allow-* permissions. Never use -A merely to make a command pass.
- Treat --allow-run and --allow-ffi as sandbox escape boundaries.
- After changes run: deno fmt --check, deno lint, deno check, and relevant deno test targets.
- Report exact commands and failures; do not claim tests you did not run.
- Ask before deleting lockfiles, changing major versions, publishing, or deploying.
Repository facts to add
- pinned Deno version and upgrade process;
- authoritative config and workspace root;
- existing dev, test, check, build, and deploy task names;
- allowed hosts, paths, and environment variable names;
- whether
package.json/node_modulescompatibility is used; - production platform and rollback workflow.
Instructions do not enforce execution boundaries. CI, containers, and the deployment platform still need least privilege and approvals.