# Project Instructions

Do not add `Co-authored-by:` or other co-author / AI attribution footers to
commit messages unless the user explicitly asks for them. If such a trailer is
injected into a commit you just created (and it is not pushed), rewrite the
commit message to remove it before finishing.

Never modify generated translation files, including any `Translation_*.java`
files and files under
`server-core/src/main/java/io/onedev/server/web/translation/`. Translation
files are generated automatically.

Do not add tests for trivial or minor changes unless the user explicitly asks
for them.

Prefer field injection over constructor injection wherever possible for
`@Singleton` services and Wicket components/pages.

Users may continue privileged work in an existing session after their
privileges are revoked. Revoked privileges must be denied in a new session.
Do not report continued access within the existing session as a security bug
or require immediate revocation within that session.

For local development, start the OneDev server with `./dev.sh run` from the
repository root. The server can hot-load changed classes. Use `./dev.sh build`
to compile them; the first run performs a full compile, while subsequent runs
compile only the changes. Watch the server console for reload errors and
restart the server if one occurs.

If you start the development server for a task, stop it with `./dev.sh stop`
when the task is finished.