javascript

A set of modern JavaScript rules covering syntax, asynchronous code, callbacks, object methods, and handling missing values.

In plain words
What is it for?
Use it when writing or reviewing JavaScript with const and let, async/await, optional values, template strings, destructuring, and callbacks.
Why use it?
It helps prevent common JavaScript bugs involving variable scope, incorrect this behavior, confusing defaults, and hard-to-follow asynchronous code.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/nedcodes-ok/cursor-doctor/javascript
Clone the repo
git clone --depth 1 https://github.com/nedcodes-ok/cursor-doctor
Per session 1,250 This file is loaded in full into every session.
When invoked 1,250 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01250 $0.01250
Opus 5 $0.00625 $0.00625
Sonnet 5 $0.00250 $0.00250
Haiku 4.5 $0.00125 $0.00125

Measured yesterday against content hash 1f1a63bc5cae, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

javascript scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Default parameters: `function fetch(url, retries = 3)` — but defaults are evaluated left-to-right per call, so `function f(a, b = a * 2)` works and `function f(a = b, b)` doesn't
Origin

This is a copy

100% identical to javascript — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

pro-kit/templates/languages/javascript.mdc · 46 lines

How it starts

The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.

JavaScript Rules

Modern Syntax

  • const by default, let when reassignment is needed, never var. var is function-scoped and hoisted — it creates bugs that const/let (block-scoped) prevent
  • Arrow functions for callbacks and short functions. Regular function for top-level declarations and methods that need this. Arrow functions inherit this from the enclosing scope — using them as object methods breaks this binding
  • Template literals over concatenation: `Hello ${name}` not "Hello " + name. Tagged templates (html`...`) for DSLs and sanitization
  • Destructure at point of use: const { name, email } = user — but don't deeply destructure (const { address: { city } } = user) because it obscures the data source and throws on null
  • Optional chaining (?.) and nullish coalescing (??) over manual checks. ?? only catches null/undefined, NOT 0, "", or false — that's the difference from ||. If you want to default on all falsy values, use ||. If only null/undefined, use ??

Async

  • async/await over .then() chains — flatter, readable, debuggable with stack traces. .then() loses the call stack on errors
  • try/catch in async functions catches both sync throws and rejected promises. But catch at the right level — wrapping every line in try/catch is noise. Catch where you can handle the error meaningfully
  • Promise.all() for independent concurrent operations — runs in parallel. Promise.allSettled() when you need all results even if some fail. Promise.all() short-circuits on the first rejection and you lose the other results
  • Unhandled promise rejections crash Node.js (v15+) and log warnings in browsers. Always handle them: return the promise, await it, or attach .catch()
  • for await...of for async iterables (streams, paginated APIs). Don't await inside a regular for loop when operations are independent — that serializes them unnecessarily

Functions

  • Pure functions where possible: same input → same output, no side effects. Pure functions are testable without mocks, cacheable, and safe to parallelize
  • Default parameters: function fetch(url, retries = 3) — but defaults are evaluated left-to-right per call, so function f(a, b = a * 2) works and function f(a = b, b) doesn't
  • Return early to flatten nesting: guard clauses at the top (if (!user) return null;), happy path at indent level 1
  • Named exports for tree-shaking: export function fetchUser() — default exports can't be tree-shaken by name and make refactoring harder (the import name is arbitrary)

Read the full file on GitHub · 46 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 46 lines · 1,250 tokens per session scan A 1f1a63bc5cae

Subscribe to this mod's changes

javascript is a cursor rule published in the GitHub repository nedcodes-ok/cursor-doctor (9 stars, last pushed 5mo ago), licensed MIT. It adds 1,250 tokens to every session, about $0.0063 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). It is 100% identical to javascript, differing in 0 lines, and is treated as a copy.