DialectOS: Cursor rule for Cursor

.cursorrules

cursorrules is a cursor rule for Cursor from KyaniteLabs/DialectOS. It costs 507 tokens per session, scanned A, original, Apache-2.0.

A set of coding rules for KyaniteLabs repositories. It covers issue-based development, code quality, security, testing, Git practices, and keeping the working directory clean.

In plain words
What is it for?
It is for guiding work in KyaniteLabs repositories: formatting and linting code, checking security risks, writing tests, preparing pull requests, and following the repository workflow.
Why use it?
It gives an agent project-specific expectations for writing, checking, and submitting code, including how to handle secrets, external input, tests, and branches.

Cursor rule for Cursor

Written for Cursor: installed under .cursor/.

This is KyaniteLabs/DialectOS's own configuration. It tells Cursor how to work on DialectOS itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything DialectOS configures →

Reuse

Borrowing it

Nothing to install: this file belongs to KyaniteLabs/DialectOS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/KyaniteLabs/DialectOS/main/.cursorrules
Clone the repo
git clone --depth 1 https://github.com/KyaniteLabs/DialectOS

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for cursorrules

README.md
[![agentmods](https://agentmods.dev/badge/rules/kyanitelabs/dialectos/cursorrules/github.svg)](https://agentmods.dev/rules/kyanitelabs/dialectos/cursorrules)
Your own site
<a href="https://agentmods.dev/rules/kyanitelabs/dialectos/cursorrules"><img src="https://agentmods.dev/badge/rules/kyanitelabs/dialectos/cursorrules/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for cursorrules

Your own site · 80×15
<a href="https://agentmods.dev/rules/kyanitelabs/dialectos/cursorrules"><img src="https://agentmods.dev/badge/rules/kyanitelabs/dialectos/cursorrules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 507 This file is loaded in full into every session.
When invoked 507 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00507 $0.00507
Opus 5.5 $0.00203 $0.00203
Sonnet 5.5 $0.00101 $0.00101
Haiku 4.5 $0.00051 $0.00051

Measured 1mo ago against content hash 30e9ecb2fdee, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

cursorrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

.cursorrules · 60 lines

How it starts

The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.

KyaniteLabs — AI Agent Instructions

Organization

  • Org: KyaniteLabs, owner: simongonzalezdc
  • All repos use issue-driven development — contributions enter as GitHub issues, not direct PRs
  • Pipeline runs every 30 min: triage → fix → review → merge
  • All main/master branches are protected (no direct push, CI required)

Code Quality

  • Formatter: ruff (Python), prettier (JS/TS)
  • Linter: ruff (Python), eslint (JS/TS)
  • Config: pyproject.toml (Python), pnpm (Node)
  • Pin exact dependency versions
  • No orphaned code — every function called, every file imported
  • No commented-out code blocks

Security

  • No shell=True with user input
  • No hardcoded secrets/tokens/API keys
  • Validate file paths (no path traversal)
  • Use HTTPS for external calls
  • Parameterized queries for databases

Testing

  • Test behavior, not implementation
  • Test the unhappy path (API down, file missing, bad input)
  • Integration tests over mocks for external systems
  • One assertion per concept

Git

  • Commits tell why, not what
  • PRs under 400 lines
  • Rebase, don't merge on feature branches
  • Never skip CI

Git Workspace Hygiene

  • Delete feature branches after merge — no stale branches
  • Remove worktrees when done — no orphaned worktrees
  • Prune stale remote references (git remote prune origin)
  • Clean working directory when task is done (git status clean)
  • Delete abandoned branches — don't leave dead work behind
  • Main branch is the only permanent artifact — everything else is temporary

Epoch Data Tracking

  • Use Epoch for time estimation before starting tasks (MCP, REST API, or CLI)
  • Record actual time after completing tasks (record_actual)
  • Every project feeds data to Epoch — it's how the system learns
  • Epoch only works if everyone contributes estimate-vs-actual data

Local LLM

  • Use local inference at localhost:1234 before cloud APIs
  • Check loaded models first, don't touch models you didn't load
  • Unload when done
  • CPU thread pool: 10, flash attention: on, KV cache: Q8

Read the full file on GitHub · 60 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 60 lines · 507 tokens per session scan A 30e9ecb2fdee

Subscribe to this mod's changes

cursorrules is a cursor rule published in the GitHub repository KyaniteLabs/DialectOS (4 stars, last pushed 14d ago), licensed Apache-2.0. It adds 507 tokens to every session, about $0.0020 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.