lib

Project rules that require a specific Node.js version and set versions and usage guidelines for the libraries listed in package.json. They cover command-line interfaces, terminal output, prompts, loading indicators, file handling, linting, and formatting.

In plain words
What is it for?
Use them when adding or changing features in a Node.js project, especially when working with the listed command-line, file-system, code-checking, or formatting libraries.
Why use it?
They reduce compatibility problems and keep different parts of the codebase using the same library versions and conventions.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/rosendolu/cursor-rules-deploy/lib
Clone the repo
git clone --depth 1 https://github.com/rosendolu/cursor-rules-deploy

Made for: Cursor.

Per session 708 This file is loaded in full into every session.
When invoked 708 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00708 $0.00708
Opus 5 $0.00354 $0.00354
Sonnet 5 $0.00142 $0.00142
Haiku 4.5 $0.00071 $0.00071

Measured 2d ago against content hash a971933e0d18, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

lib scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/lib.mdc · 100 lines

How it starts

The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Library Version and Feature Constraints

Required Node Version

  • Node.js version must be >= 22.14.0 as specified in package.json

Core Dependencies

Use these specific versions and their features:

CLI and Utility Libraries

  • commander (^11.0.0)

    • Use for command-line interface implementation
    • Prefer declarative command definitions
    • Utilize built-in option validation
  • chalk (^5.3.0)

    • Use for terminal text styling
    • Prefer template literals with chalk
    • Use consistent color schemes for different message types
  • inquirer (^9.2.12)

    • Use for interactive command-line prompts
    • Prefer async/await syntax with prompts
    • Utilize built-in validation features
  • ora (^8.0.1)

    • Use for loading spinners
    • Implement with async operations
    • Use consistent spinner styles

File System Operations

  • fs-extra (^11.2.0)
    • Prefer fs-extra methods over native fs
    • Use promise-based API
    • Utilize built-in error handling

Development Tools

  • eslint (^8.56.0)

    • Follow project's ESLint configuration
    • Address all ESLint warnings and errors
  • prettier (^3.2.5)

    • Maintain consistent code formatting
    • Use project's Prettier configuration

Best Practices

  1. Always use the latest features available in the specified versions
  2. Prefer built-in functionality over custom implementations
  3. Use TypeScript types when available
  4. Handle version-specific features gracefully

Version Upgrade Guidelines

  1. Document any version-specific changes
  2. Test compatibility when upgrading dependencies
  3. Update related code when library versions change
  4. Maintain backward compatibility where possible

Code Examples

Command Line Interface (commander)

// Preferred
program
  .name('cursor-rules-deploy')
  .description('Deploy Cursor AI rules and templates')
  .version('1.0.0');

// Avoid
if (process.argv.includes('--version')) {
  console.log('1.0.0');
}

Logging (chalk)

// Preferred - Always use Logger class with chalk
Logger.info(chalk.blue('Processing'), chalk.green(filename));
Logger.error(chalk.red('Error:'), chalk.yellow(errorMessage));
Logger.warn(chalk.yellow('Warning:'), chalk.dim(warningMessage));
Logger.debug(chalk.gray('Debug:'), chalk.dim(debugInfo));

// Avoid
console.log('Processing', filename);
console.error('Error:', errorMessage);
console.warn('Warning:', warningMessage);
console.debug('Debug:', debugInfo);

Read the full file on GitHub · 100 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 100 lines · 708 tokens per session scan A a971933e0d18

Subscribe to this mod's changes

lib is a cursor rule published in the GitHub repository rosendolu/cursor-rules-deploy (37 stars, last pushed 1y ago), licensed MIT. It adds 708 tokens to every session, about $0.0035 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.