Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/gosha70/code-copilot-team/visual-reviewgit clone --depth 1 https://github.com/gosha70/code-copilot-teamWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.01106 |
| Opus 5 | $0.00028 | $0.00553 |
| Sonnet 5 | $0.00011 | $0.00221 |
| Haiku 4.5 | $0.00006 | $0.00111 |
Grade A, and why
visual-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Visual Review Loop Protocol
Invoke after UI is built against the design-system bundle. Generation alone can't
be trusted — this loop verifies the rendered result against the committed
DESIGN.md and fails the build until the bar is met.
The loop
build → boot dev server → rubric pre-filter (cheap, deterministic)
→ axe-core a11y gate (fail-fast)
→ Playwright screenshot @ 375 / 768 / 1440
→ CRITIC scores screenshots vs DESIGN.md rubric
→ triage [Blocker/High/Medium/Nitpick] → write critique-feedback.json
→ coding agent applies fixes → re-run → check exit criteria
Deterministic harness + pluggable critic. The harness/ runner does the
identical-for-every-copilot parts (boot, screenshot, axe, rubric pre-filter, emit
artifacts). The critic (aesthetic judgment) is either:
- Agent critic (Claude Code): the
visual-revieweragent reads the PNGs directly (a picture is worth 1000 tokens) and scores them. - Runner critic (any other copilot): the runner calls a vision-LLM (provider,
model, key from env) and writes
critique-feedback.json.
Same rubric, same gates, same exit criteria — only the critic swaps.
Running it
From the project root: npm run copilot:review (wraps harness/). It:
- runs the a11y + rubric gates; on failure writes
tmp/ui-review/critique-feedback.jsonand exits non-zero; - captures screenshots at the three breakpoints;
- runs the critic;
- exits
0only when all exit criteria pass (vision critic), or after emitting artifacts for the agent critic to judge.
The coding agent reads tmp/ui-review/critique-feedback.json ({passed, critiqueSummary, actionableFixes[]}), applies the fixes, and re-runs. Never
hand-wave a failing gate — fix the UI.
The critic rubric (score each; source of truth is DESIGN.md)
Phased, adapted from published design-review agents (OneRedOak, Anthropic frontend-design, shiplightai):
- Typography — modular scale, real hierarchy, committed pairing (no default fonts).
- Spacing & layout — 4/8pt rhythm, internal ≤ external spacing, deliberate layout grammar (no lone centered column, no cardocalypse).
- Color & theme — semantic-token discipline, dominant + sharp accent (not evenly distributed), light/dark parity, no banned gradients.
- Hierarchy — one primary CTA per screen; attention guided by size/weight/space.
- States — empty/loading/error/success/focus present for every data component.
- Anti-slop flags — any Step-3 tell from
design-systempresent ⇒ automatic fail. - Domain fit — does it match the archetype/density locked in DESIGN.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 90 lines · 57 tokens per session scan A 3580862fe35f
visual-review is a cursor rule published in the GitHub repository gosha70/code-copilot-team (6 stars, last pushed 2d ago), licensed MIT. It adds 57 tokens to every session and 1,106 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.
python_lib
Tips and guidelines specific to the development of the Streamlit Python library, not applicable to scripts and e2e tests.
specs
This directory contains product and tech specs for Streamlit features.