Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/double-coding-lab/Flow2SpecWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/double-coding-lab/flow2spec/repo-dev-workflow-constraints)<a href="https://agentmods.dev/rules/double-coding-lab/flow2spec/repo-dev-workflow-constraints"><img src="https://agentmods.dev/badge/rules/double-coding-lab/flow2spec/repo-dev-workflow-constraints/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/double-coding-lab/flow2spec/repo-dev-workflow-constraints"><img src="https://agentmods.dev/badge/rules/double-coding-lab/flow2spec/repo-dev-workflow-constraints.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01751 |
| Opus 5.5 | $0.00013 | $0.00700 |
| Sonnet 5.5 | $0.00007 | $0.00350 |
| Haiku 4.5 | $0.00003 | $0.00175 |
Grade A, and why
repo-dev-workflow-constraints scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flow2Spec 项目开发纪律(Dev Workflow Constraints)
仅适用于 Flow2Spec 本仓自身开发,不下发给普通业务仓。
三端同源手写镜像:
- Claude:
.claude/rules/repo-dev-workflow-constraints.md- Cursor:
.cursor/rules/repo-dev-workflow-constraints.mdc- Codex:
.codex/topics/repo-dev-workflow-constraints.md- 路由摘要:
.Knowledge/topics/f2s-dev-workflow-constraints.md
所有权边界
| 位置 | 角色 | 写入方式 |
|---|---|---|
packages/core/templates/{zh-CN,en-US}/ |
下游 Rule、Skill、Hook、知识模板的唯一真源;随 Core tarball 发布 | 人或 Agent 直接维护并提交 Git |
.claude/ / .cursor/ / .codex/ / 根 AGENTS.md |
本仓消费模板后的配置根产物 | 用户明确要求后由 flow2spec init / npm run sync:agents 分发 |
.Knowledge/ |
本仓共享知识库 | 按 topic/skill 写权直接维护 |
本仓专属 repo-* Rule/Skill |
只服务本仓,不进入 Core templates | 三端配置根手写镜像 |
根 templates/ 与根 lib/ 均不再存在:模板和核心实现分别由 packages/core/templates/、packages/core/lib/ 单独持有。packages/core/templates/ 受 Git 管理,不依赖复制脚本、.gitignore 例外或 prepack 同步。
硬约束
- 下游会使用的 Rule、Skill、Hook、AGENTS、配置与知识模板,只改
packages/core/templates/zh-CN/和packages/core/templates/en-US/;双语版本保持语义一致。 - 不直接编辑配置根中由 Core templates 派生的文件。它们会在后续
init中被覆盖。 - 本规则、
repo-dev-check等本仓专属内容不进 Core templates,直接同步三端手写镜像与本仓知识库。 - Agent 不主动执行
flow2spec init/npm run sync:agents;只有用户明确要求分发时才执行。 - 根
lib/不作为兼容入口。CLI 通过createFlow2Spec()等 Core 公共 API 工作;Core 内部测试可按需引用packages/core/lib/。
修改判断
- 通用能力:改
packages/core/templates/{locale}/...,必要时同步 Core 实现与公开文档。 - 本仓知识:改
.Knowledge/topics/、matcher、manifest/index;触达 topic 时先读f2s-topic-authoring。 - 本仓专属纪律:改三端
repo-dev-workflow-constraints镜像,不写入 Core templates。 - 配置根派生产物:不手改,也不为预览主动执行 init。
版本模型
CLI Version packages/cli/package.json
Core Version packages/core/package.json
Template Version packages/core/package.json.templateVersion
Protocol Version packages/core/capabilities.json.protocolVersion
- CLI 对 Core 使用运行时 caret 兼容范围(如
^3.8.2);已安装依赖通过显式更新刷新,不会静默变化。 - Core 在 CLI 兼容范围内的更新可独立发布,
version:set:core保留 CLI 版本和依赖范围;不兼容时在写盘前报错。 - Rule、Skill、Hook、知识模板变化时升 Core,并显式执行
version:set:template;兼容变更无需为此升 CLI。 - CLI 开始调用新版 Core API 时,升 CLI 并通过
version:set:cli --core-range ^x.y.z调整兼容下限;不兼容升级须显式评估。 - Protocol Version 只在公共协议不兼容时调整。
- 根 private workspace version 不参与 npm 发布匹配。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 76dec7f3432c
- 1mo ago Changed · +13 lines 74211a70b6be
- 1mo ago First seen · 90 lines · 33 tokens per session scan A e8f45e8d2e9d
repo-dev-workflow-constraints is a cursor rule published in the GitHub repository double-coding-lab/Flow2Spec (52 stars, last pushed 6d ago), licensed MIT. It adds 33 tokens to every session and 1,751 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
prefer-assertions-over-defensive-checks
Prefer assertions over defensive checks when data is guaranteed to be valid.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
as-contract-cast-smell
// ❌ WRONG — bypasses the family ContractSerializer seam const contract = JSON.parse(raw) as Contract; const contract = JSON.parse(raw) as Contract .