feat(settings): personal rules added to system prompts

[Bl3f]

Problem

Closes #936. Users had no way to define personal rules/preferences that shape how nao responds — they could only edit memories the agent already created.

What this adds

• A new Settings → Rules page where each user can create, edit, and delete personal rules.
• Personal rules are injected into the system prompt under User Rules → Personal Rules, layered on top of the global project rules (RULES.md).
• Rules are scoped per project and apply only to that user's own chats.
• Rules are visible to the context recommendation system so it can detect de-facto rules (e.g. if multiple users define similar rules, it can suggest promoting them to shared context).

Implementation notes

Per the issue suggestion, this reuses the existing memories table instead of creating a new one:

• Added a new memory category personal_rule (apps/backend/src/types/memory.ts).
• Added a nullable project_id column to memories (sqlite + postgres migrations 0050) to scope personal rules to a project.
• Personal rules are hidden from the Memory settings page (user.getMemories now excludes them) and surfaced only on the new Rules page.
• New rule tRPC router (list/create/update/delete), project-scoped.
• System prompt renders personal rules in the User Rules section (system-prompt.tsx).
• v_memories view now also exposes project_id and includes project-scoped rows so query_app_db / the recommendation bot can read personal rules; the recommendation prompt now calls out category = "personal_rule" for promotion to shared context.

Testing

• npm run lint (backend, frontend, shared) ✅
• npm run -w @nao/backend db:check-migrations ✅
• Backend vitest: no new failures introduced (10 pre-existing failures on main unrelated to this change).
• Manual end-to-end testing through the UI (see walkthrough on the agent summary).

  

[github-actions]

🚀 Preview Deployment

URL	https://pr-944-1d02f6b.preview.getnao.io
Commit	1d02f6b

⚠️ No LLM API keys configured - you'll see the API key setup flow when trying to chat.

---

_{Preview will be automatically removed when this PR is closed.}

[cursor]

Stale comment

Identified one net-new security finding after module triage and deduplication.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM

rule.update and rule.delete delegate to generic memory mutators keyed only by userId + ruleId. These routes are project-scoped features, but the write/delete path does not enforce projectId (or personal_rule category), so a known rule ID from another project can still be modified or deleted.

Impact: project-level isolation for personal rules can be bypassed, enabling cross-project rule tampering.

 

^{Reviewed by Cursor Security Reviewer for commit bf4eccc. Configure here.}

[cubic-dev-ai]

3 issues found across 23 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/backend/src/trpc/rule.routes.ts">

<violation number="1" location="apps/backend/src/trpc/rule.routes.ts:39">
P1: Update and delete mutations lack project scoping — they don't pass `ctx.project.id`, so a user could modify or delete personal rules from other projects within the same user scope. Breaks the per-project isolation intent.</violation>
</file>

<file name="apps/backend/src/components/ai/system-prompt.tsx">

<violation number="1" location="apps/backend/src/components/ai/system-prompt.tsx:200">
P3: Missing `key` prop on `ListItem` in `personalRules.map()`. React requires a stable key for list reconciliation; omitting it causes unnecessary re-renders and potential state bugs if the list can change.</violation>
</file>

<file name="apps/backend/migrations-sqlite/0050_add_memories_project_id.sql">

<violation number="1" location="apps/backend/migrations-sqlite/0050_add_memories_project_id.sql:1">
P1: SQLite migration misses `ON DELETE CASCADE` for `memories.project_id`, causing schema/migration mismatch and potentially leaving project-scoped memories undeleted.</violation>
</file>

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Update and delete mutations lack project scoping — they don't pass ctx.project.id, so a user could modify or delete personal rules from other projects within the same user scope. Breaks the per-project isolation intent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/backend/src/trpc/rule.routes.ts, line 39:

<comment>Update and delete mutations lack project scoping — they don't pass `ctx.project.id`, so a user could modify or delete personal rules from other projects within the same user scope. Breaks the per-project isolation intent.</comment>

<file context>
@@ -0,0 +1,62 @@
+			if (!content) {
+				throw new TRPCError({ code: 'BAD_REQUEST', message: 'Rule content cannot be empty.' });
+			}
+			const updated = await memoryQueries.updateUserMemoryContent(ctx.user.id, input.ruleId, content);
+			if (!updated) {
+				throw new TRPCError({ code: 'NOT_FOUND', message: 'Rule not found.' });
</file context>

[cubic-dev-ai]

P1: SQLite migration misses ON DELETE CASCADE for memories.project_id, causing schema/migration mismatch and potentially leaving project-scoped memories undeleted.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/backend/migrations-sqlite/0050_add_memories_project_id.sql, line 1:

<comment>SQLite migration misses `ON DELETE CASCADE` for `memories.project_id`, causing schema/migration mismatch and potentially leaving project-scoped memories undeleted.</comment>

<file context>
@@ -0,0 +1,2 @@
+ALTER TABLE `memories` ADD `project_id` text REFERENCES project(id);--> statement-breakpoint
+CREATE INDEX `memories_projectId_idx` ON `memories` (`project_id`);
\ No newline at end of file
</file context>

[cubic-dev-ai]

P3: Missing key prop on ListItem in personalRules.map(). React requires a stable key for list reconciliation; omitting it causes unnecessary re-renders and potential state bugs if the list can change.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/backend/src/components/ai/system-prompt.tsx, line 200:

<comment>Missing `key` prop on `ListItem` in `personalRules.map()`. React requires a stable key for list reconciliation; omitting it causes unnecessary re-renders and potential state bugs if the list can change.</comment>

<file context>
@@ -186,10 +188,21 @@ export function SystemPrompt({
+								<Title level={3}>Personal Rules</Title>
+								<Span>These rules were defined by the user in their settings. Always follow them.</Span>
+								<List>
+									{personalRules.map((rule) => (
+										<ListItem>{rule.content}</ListItem>
+									))}
</file context>