Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/double-coding-lab/flow2spec/repo-dev-workflow-constraintsgit clone --depth 1 https://github.com/double-coding-lab/Flow2SpecWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.01340 |
| Opus 5 | $0.00016 | $0.00670 |
| Sonnet 5 | $0.00007 | $0.00268 |
| Haiku 4.5 | $0.00003 | $0.00134 |
Grade A, and why
repo-dev-workflow-constraints scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flow2Spec 项目开发纪律(Dev Workflow Constraints)
仅适用于 Flow2Spec 本仓自身开发,不下发给普通业务仓。
三端同源手写镜像:
- Claude:
.claude/rules/repo-dev-workflow-constraints.md- Cursor:
.cursor/rules/repo-dev-workflow-constraints.mdc- Codex:
.codex/topics/repo-dev-workflow-constraints.md- 路由摘要:
.Knowledge/topics/f2s-dev-workflow-constraints.md
所有权边界
| 位置 | 角色 | 写入方式 |
|---|---|---|
packages/core/templates/{zh-CN,en-US}/ |
下游 Rule、Skill、Hook、知识模板的唯一真源;随 Core tarball 发布 | 人或 Agent 直接维护并提交 Git |
.claude/ / .cursor/ / .codex/ / 根 AGENTS.md |
本仓消费模板后的配置根产物 | 用户明确要求后由 flow2spec init / npm run sync:agents 分发 |
.Knowledge/ |
本仓共享知识库 | 按 topic/skill 写权直接维护 |
本仓专属 repo-* Rule/Skill |
只服务本仓,不进入 Core templates | 三端配置根手写镜像 |
根 templates/ 与根 lib/ 均不再存在:模板和核心实现分别由 packages/core/templates/、packages/core/lib/ 单独持有。packages/core/templates/ 受 Git 管理,不依赖复制脚本、.gitignore 例外或 prepack 同步。
硬约束
- 下游会使用的 Rule、Skill、Hook、AGENTS、配置与知识模板,只改
packages/core/templates/zh-CN/和packages/core/templates/en-US/;双语版本保持语义一致。 - 不直接编辑配置根中由 Core templates 派生的文件。它们会在后续
init中被覆盖。 - 本规则、
repo-dev-check等本仓专属内容不进 Core templates,直接同步三端手写镜像与本仓知识库。 - Agent 不主动执行
flow2spec init/npm run sync:agents;只有用户明确要求分发时才执行。 - 根
lib/不作为兼容入口。CLI 通过createFlow2Spec()等 Core 公共 API 工作;Core 内部测试可按需引用packages/core/lib/。
修改判断
- 通用能力:改
packages/core/templates/{locale}/...,必要时同步 Core 实现与公开文档。 - 本仓知识:改
.Knowledge/topics/、matcher、manifest/index;触达 topic 时先读f2s-topic-authoring。 - 本仓专属纪律:改三端
repo-dev-workflow-constraints镜像,不写入 Core templates。 - 配置根派生产物:不手改,也不为预览主动执行 init。
版本模型
CLI Version packages/cli/package.json
Core Version packages/core/package.json
Template Version packages/core/package.json.templateVersion
Protocol Version packages/core/capabilities.json.protocolVersion
- CLI 对 Core 使用运行时依赖 caret range(当前为
^3.5.0);Core 必须落在该范围内。 - Core 兼容修复/新增 API 可只升 Core;Template Version 不变,不触发知识库升级。
- Rule、Skill、Hook、知识模板变化时升 Core,并显式执行
version:set:template。 - CLI 开始调用新版 Core API 时,升 CLI 并显式提高最低 Core range。
- Protocol Version 只在公共协议不兼容时调整。
- 根 private workspace version 不参与 npm 发布匹配。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 90 lines · 33 tokens per session scan A e8f45e8d2e9d
repo-dev-workflow-constraints is a cursor rule published in the GitHub repository double-coding-lab/Flow2Spec (47 stars, last pushed 5d ago), licensed MIT. It adds 33 tokens to every session and 1,340 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.