Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/proyecto26/projectx/packages-rulesgit clone --depth 1 https://github.com/proyecto26/projectxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02860 | $0.02860 |
| Opus 5 | $0.01430 | $0.01430 |
| Sonnet 5 | $0.00572 | $0.00572 |
| Haiku 4.5 | $0.00286 | $0.00286 |
Grade A, and why
packages-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 434 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backend Packages Rules
Package Overview
Core (@projectx/core)
- Purpose: Shared backend utilities, authentication, health checks, logging
- Module System: Dual (CJS + ESM via tsup)
- Exports: AuthService, JwtAuthGuard, HealthModule, Logger utilities
- Dependencies: NestJS, Passport, JWT
DB (@projectx/db)
- Purpose: Prisma client and database utilities
- Module System: Dual (CJS + ESM via tsup)
- Exports: PrismaService, DbModule, Prisma client
- Database: PostgreSQL with PostGIS extension
Email (@projectx/email)
- Purpose: Email sending via SendGrid
- Module System: Dual (CJS + ESM via tsup)
- Exports: EmailService, EmailModule
- Provider: SendGrid
Payment (@projectx/payment)
- Purpose: Stripe payment integration
- Module System: Dual (CJS + ESM via tsup)
- Exports: StripeService, PaymentModule
- Provider: Stripe
Workflows (@projectx/workflows)
- Purpose: Temporal workflow client and worker management
- Module System: Dual (CJS + ESM via tsup)
- Exports: ClientService, WorkerService, WorkflowsModule
- Integration: Temporal.io
Build Configuration
All packages use tsup for dual builds
{
"scripts": {
"build": "tsup src/index.ts --format cjs,esm --sourcemap --clean"
}
}
Build outputs:
dist/index.js- CommonJS (for NestJS apps)dist/index.mjs- ESM (for web app)dist/index.d.ts- TypeScript declarations- Source maps for both formats
Critical: Declaration files
# Always generate declaration files
tsup src/index.ts --format cjs,esm --sourcemap --clean && \
tsc -p tsconfig.json --emitDeclarationOnly --outDir dist
Package: @projectx/core
Exports
// Authentication
export { AuthService } from './lib/auth/auth.service';
export { JwtAuthGuard } from './lib/auth/auth.guard';
export { JwtStrategy } from './lib/auth/jwt.strategy';
export { AuthModule } from './lib/auth/auth.module';
// Decorators
export { AuthenticatedUser } from './lib/auth/auth.decorator';
// Health checks
export { HealthModule } from './lib/health/health.module';
// Logger
export { createLoggerOptions } from './lib/logger';
// Workflows (Temporal)
export {
verifyLoginCodeUpdate,
createOrderUpdate,
getOrderStateQuery,
cancelWorkflowSignal,
paymentWebHookEventSignal
} from './workflows';
// Types
export type { AuthUser, OrderWorkflowData, PaymentWebhookEvent };
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 434 lines · 2,860 tokens per session scan A 2c0e01dc78a8
packages-rules is a cursor rule published in the GitHub repository proyecto26/projectx (83 stars, last pushed 4mo ago), licensed MIT. It adds 2,860 tokens to every session, about $0.0143 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
ai-development
CodeSpirit AI功能开发规范 - AI表单填充、长任务处理、LLM集成.
js
CodeSpirit JavaScript 开发规范 - AMIS集成、模块模式、API请求、Token管理.
controller
CodeSpirit 控制器开发规范 - API控制器特性、路由、响应格式和操作特性.
database
CodeSpirit 数据库与 EF Core 迁移规范 - 多数据库支持、DbContext 设计、迁移命令.
dependency-injection
CodeSpirit 依赖注入规范 - Scrutor自动注册、生命周期管理.
api-design
CodeSpirit API 设计规范 - RESTful、路由、响应格式等.