Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/eliornl/rolemule/websocket-patternsgit clone --depth 1 https://github.com/eliornl/rolemuleWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02816 |
| Opus 5 | $0.00000 | $0.01408 |
| Sonnet 5 | $0.00000 | $0.00563 |
| Haiku 4.5 | $0.00000 | $0.00282 |
Grade A, and why
websocket-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WebSocket Patterns
Endpoints
WS /api/v1/ws/workflow/{session_id}?token=JWT # session-scoped updates
WS /api/v1/ws/user?token=JWT # all updates for a user
Token goes in the query string. This is the only place in the codebase where a JWT is allowed in a URL parameter — the WebSocket protocol has no concept of custom request headers, so there is no alternative. extract_token_from_request in utils/auth.py enforces this: query-param tokens are accepted only for paths starting with /api/ws/. All regular HTTP endpoints require Authorization: Bearer <token>.
Connection Limits
- Max 5 connections per user
- Max 3 connections per session
Complete Broadcast Function Reference
All broadcast functions live in api/websocket.py and follow the same signature:
- Always send to both session-scoped subscribers and general user subscribers.
- Always safe to
awaitfrom any background task — they swallow send errors gracefully.
Main Workflow Broadcasts (called by workflows/job_application_workflow.py)
from api.websocket import (
broadcast_agent_update,
broadcast_phase_change,
broadcast_workflow_complete,
broadcast_workflow_error,
broadcast_gate_decision,
)
await broadcast_agent_update(
user_id=user_id,
session_id=session_id,
agent_name="job_analyzer",
status="running", # running | completed | failed
message="Analyzing job posting...",
)
await broadcast_phase_change(
user_id=user_id,
session_id=session_id,
phase="profile_matching",
progress_percentage=60,
)
await broadcast_workflow_complete(user_id=user_id, session_id=session_id, result_summary=result)
await broadcast_workflow_error(user_id=user_id, session_id=session_id, error_message=error_msg, failed_agent="job_analyzer")
await broadcast_gate_decision(user_id=user_id, session_id=session_id, match_score=0.82, recommendation="Strong match")
Workflow Control Broadcasts (called by api/workflow.py background tasks)
from api.websocket import (
broadcast_workflow_resumed,
broadcast_document_generation_started,
)
# Sent at the start of _continue_workflow_background (after gate confirmation)
await broadcast_workflow_resumed(user_id=user_id, session_id=session_id)
# Sent at the start of _generate_documents_background
await broadcast_document_generation_started(user_id=user_id, session_id=session_id)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 284 lines · 0 tokens per session scan A 47b131eab24e
websocket-patterns is a cursor rule published in the GitHub repository eliornl/rolemule (37 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,816 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
real-browser-mcp
Instructions for using Real Browser MCP to control the user's actual browser.
project
Core project context for real-browser-mcp.
invictum-browser
Use Invictum Browser Bridge whenever the user requests IBB, IBG, Invictum Browser Bridge, or Invictum Browser Gate.
imports-order
Ignore unsorted/unformatted import block linting.
cursorrules
Bridge between MCP protocol and Chrome extensions. Connect AI models to browser capabilities.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.