/**
 * Universal AI Developer Baseline — curated lessons installed during `totem init`.
 *
 * These lessons provide immediate Day-1 value for any AI-assisted project.
 * Format matches what `add_lesson` produces so the markdown chunker indexes them correctly.
 */
export declare const BASELINE_MARKER = "<!-- totem:baseline -->";
export declare const UNIVERSAL_LESSONS_MARKDOWN = "\n<!-- totem:baseline -->\n\n## Lesson \u2014 Prompt Injection Prevention\n\n**Tags:** security, prompt-injection, trap\n\nNever trust raw text from external sources (PR comments, issue bodies, user input) when feeding it to an AI agent. Always sanitize or escape untrusted content before persisting it to memory files or passing it as context. Indirect prompt injection can cause agents to execute unintended actions.\n\n## Lesson \u2014 Secret Management\n\n**Tags:** security, secrets, trap\n\nNever commit API keys, tokens, or credentials to version control \u2014 even in `.env.example` files. Use environment variables loaded at runtime. If a secret is accidentally committed, rotate it immediately; removing it from git history alone is not sufficient.\n\n## Lesson \u2014 AI Hallucination Traps\n\n**Tags:** ai-behavior, hallucination, trap\n\nAI agents will confidently reference APIs, functions, database tables, and configuration options that do not exist. Always verify AI-generated code against the actual codebase and documentation before merging. Prefer semantic search over asking the agent to \"remember\" prior context.\n\n## Lesson \u2014 Scope Creep Prevention\n\n**Tags:** ai-behavior, scope-creep, architecture\n\nWhen an AI agent proposes a \"small improvement\" or \"quick refactor\" alongside the requested change, reject it. Unrelated changes in the same commit obscure code review diffs, introduce untested side effects, and make git bisect useless.\n\n## Lesson \u2014 Dependency Verification\n\n**Tags:** architecture, dependencies, trap\n\nBefore an AI agent adds a new dependency, verify it exists, is actively maintained, and matches your project's license. AI agents frequently hallucinate package names or suggest deprecated libraries. Check the npm/PyPI registry directly.\n\n## Lesson \u2014 Meaningful Test Assertions\n\n**Tags:** testing, ai-behavior, trap\n\nAI-generated tests often pass trivially \u2014 asserting that a mock returns the value it was told to return, or testing implementation details rather than behavior. Review test assertions for meaningful coverage: does the test fail when the feature breaks?\n\n## Lesson \u2014 No Empty Catch Blocks\n\n**Tags:** architecture, error-handling, design-decision\n\nCatch blocks should never be empty. At minimum, log the error or re-throw with added context. Silent failures cause cascading bugs that are extremely difficult to diagnose. If an error truly can be ignored, add a comment explaining why.\n\n## Lesson \u2014 Shell Injection Prevention\n\n**Tags:** security, shell, trap\n\nNever interpolate user-controlled strings directly into shell commands. Use parameterized APIs or write inputs to temp files. This applies to CI/CD pipelines (GitHub Actions `run:` blocks), CLI tools, and any code that calls `exec` or `spawn`.\n\n## Lesson \u2014 Context Window Management\n\n**Tags:** ai-behavior, context-window, design-decision\n\nWhen an AI agent's context window fills up, it loses earlier instructions and begins contradicting its own prior outputs. Break long tasks into smaller, well-scoped steps. Use handoff artifacts (`totem handoff`) to preserve context across session boundaries.\n\n## Lesson \u2014 Idempotent Scaffolding\n\n**Tags:** architecture, idempotency, design-decision\n\nScaffolding commands (init, setup, install) must be idempotent \u2014 running them twice should not duplicate content, overwrite user changes, or corrupt state. Always check for existing files/content before writing, and use markers to detect prior runs.\n";
//# sourceMappingURL=universal-lessons.d.ts.map