📄 CodeRabbit inference engine (.cursor/rules/gh-cli-workflow.mdc)

Prefer not to introduce new TypeScript types; use existing interfaces whenever possible

**/*.{ts,tsx}: Use TypeScript with strict type checking
Follow consistent import order (Biome will handle import sorting)
Use consistent curly braces for all control statements
Prefer const over let; avoid var
Use object shorthand syntax whenever possible
Use async/await for asynchronous code
Use consistent error handling with proper type checks
Always sanitize sensitive data before logging
Use structured logger methods (debug/info/warn/error) with a context object instead of interpolating secrets into log strings
Use sanitizeObject for manual sanitization in non-logging contexts before persisting or further processing data

Files:

• src/providers/registry.ts
• src/redteam/strategies/index.ts
• src/redteam/strategies/freeAgent.ts
• site/docs/_shared/data/strategies.ts
• src/redteam/providers/freeAgent.ts
• src/redteam/constants/metadata.ts
• src/redteam/constants/strategies.ts

📄 CodeRabbit inference engine (src/providers/CLAUDE.md)

src/providers/**/*.ts: Each provider must implement the ApiProvider interface (see src/types/providers.ts)
Providers must transform promptfoo prompts into the provider-specific API request format
Providers must return a normalized ProviderResponse for evaluation
Providers must handle authentication, rate limits, retries, and streaming
Always sanitize logs to prevent leaking API keys; never stringify configs directly in logs
For OpenAI-compatible providers, extend OpenAiChatCompletionProvider and configure apiBaseUrl and options via super(...)
Follow configuration priority: (1) explicit config options, (2) environment variables (PROVIDER_API_KEY), (3) provider defaults

Files:

• src/providers/registry.ts

📄 CodeRabbit inference engine (src/redteam/CLAUDE.md)

Store attack transformation strategies under src/redteam/strategies/ (e.g., jailbreak.ts, prompt-injection.ts, base64.ts)

Files:

• src/redteam/strategies/index.ts
• src/redteam/strategies/freeAgent.ts

📄 CodeRabbit inference engine (src/redteam/CLAUDE.md)

src/redteam/**/*.ts: Always sanitize when logging test prompts or model outputs by passing them via the structured metadata parameter (second argument) to the logger, not raw string interpolation
Use the standardized risk severity levels: critical, high, medium, low when reporting results

Files:

• src/redteam/strategies/index.ts
• src/redteam/strategies/freeAgent.ts
• src/redteam/providers/freeAgent.ts
• src/redteam/constants/metadata.ts
• src/redteam/constants/strategies.ts

📄 CodeRabbit inference engine (.cursor/rules/gh-cli-workflow.mdc)

Any pull request that only touches files in 'site/' or 'examples/' directories must use the 'docs:' prefix in the PR title, not 'feat:' or 'fix:'

Files:

• site/docs/_shared/data/strategies.ts
• site/docs/red-team/strategies/free-agent.md

📄 CodeRabbit inference engine (.cursor/rules/gh-cli-workflow.mdc)

If the change is a feature, update the relevant documentation under 'site/'

Files:

• site/docs/_shared/data/strategies.ts
• site/docs/red-team/strategies/free-agent.md

📄 CodeRabbit inference engine (.cursor/rules/docusaurus.mdc)

site/docs/**/*.md: Prioritize minimal edits when updating existing documentation; avoid creating entirely new sections or rewriting substantial portions; focus edits on improving grammar, spelling, clarity, fixing typos, and structural improvements where needed; do not modify existing headings (h1, h2, h3, etc.) as they are often linked externally.
Structure content to reveal information progressively: begin with essential actions and information, then provide deeper context as necessary; organize information from most important to least important.
Use action-oriented language: clearly outline actionable steps users should take, use concise and direct language, prefer active voice over passive voice, and use imperative mood for instructions.
Use 'eval' instead of 'evaluation' in all documentation; when referring to command line usage, use 'npx promptfoo eval' rather than 'npx promptfoo evaluation'; maintain consistency with this terminology across all examples, code blocks, and explanations.
The project name can be written as either 'Promptfoo' (capitalized) or 'promptfoo' (lowercase) depending on context: use 'Promptfoo' at the beginning of sentences or in headings, and 'promptfoo' in code examples, terminal commands, or when referring to the package name; be consistent with the chosen capitalization within each document or section.
Each markdown documentation file must include required front matter fields: 'title' (the page title shown in search results and browser tabs) and 'description' (a concise summary of the page content, ideally 150-160 characters).
Only add a title attribute to code blocks that represent complete, runnable files; do not add titles to code fragments, partial examples, or snippets that aren't meant to be used as standalone files; this applies to all code blocks regardless of language.
Use special comment directives to highlight specific lines in code blocks: 'highlight-next-line' highlights the line immediately after the comment, 'highligh...

Files:

• site/docs/red-team/strategies/free-agent.md

📄 CodeRabbit inference engine (site/docs/CLAUDE.md)

site/docs/**/*.{md,mdx}: Use the term "eval" not "evaluation" in documentation and examples
Capitalization: use "Promptfoo" (capitalized) in prose/headings and "promptfoo" (lowercase) in code, commands, and package names
Every doc must include required front matter: title and description
Only add title= to code blocks when showing complete runnable files
Admonitions must have empty lines around their content (Prettier requirement)
Do not modify headings; they may be externally linked
Use progressive disclosure: put essential information first
Use action-oriented, imperative mood in instructions (e.g., "Install the package")

Files:

• site/docs/red-team/strategies/free-agent.md

src/types/providers.ts (1)

• ProviderOptions (39-47)

src/types/index.ts (1)

• LoadApiProviderContext (1204-1208)

src/redteam/strategies/freeAgent.ts (1)

• addFreeAgentTestCases (22-54)

src/types/index.ts (2)

• TestCaseWithPlugin (705-705)
• TestCase (703-703)

src/providers/litellm.ts (1)

• config (41-43)

src/types/providers.ts (3)

• ApiProvider (79-96)
• CallApiContextParams (49-69)
• CallApiOptionsParams (71-77)

src/redteam/remoteGeneration.ts (2)

• neverGenerateRemote (31-38)
• getRemoteGenerationUrl (11-24)

src/types/shared.ts (1)

• NunjucksFilterMap (45-45)

src/constants.ts (1)

• VERSION (6-6)

src/globalConfig/accounts.ts (1)

• getUserEmail (35-38)

src/util/fetch/index.ts (1)

• fetchWithProxy (37-131)

src/evaluatorHelpers.ts (1)

• renderPrompt (133-378)

67-67: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

76-76: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

86-86: Fenced code blocks should have a language specified

(MD040, fenced-code-language)