web

Conventions for the FastAPI web dashboard.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/thearnavrustagi/marketmenow/web
Clone the repo
git clone --depth 1 https://github.com/thearnavrustagi/marketmenow

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 499 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00499
Opus 5 $0.00000 $0.00249
Sonnet 5 $0.00000 $0.00100
Haiku 4.5 $0.00000 $0.00050

Measured today against content hash f4106adc30c6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

web scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/web.mdc · 49 lines

What it actually says

Web Dashboard Rules

Architecture

The web app spawns mmn CLI commands as subprocesses — it does not call the Python pipeline directly. cli_runner.py handles subprocess execution and progress parsing. Real-time updates flow through EventHub → WebSocket.

Adapter CLIs are mounted as hidden groups in marketmenow/cli.py (hidden=True). They don't appear in mmn --help but remain callable by the web frontend. New workflows (like reddit-launch) use mmn run <name> directly.

Key Modules

  • app.py — FastAPI app with lifespan (DB pool + queue worker), WebSocket at /ws/content/{item_id}, route registration, static/output mounts.
  • cli_runner.pyrun_cli() and run_cli_streaming(). Defines PLATFORM_META (JSON params) and BUILDERS (command constructors). Progress parsed via regex.
  • queue_worker.pyrun_queue_loop() background task. Polls DB queue, checks per-platform rate limits, calls run_cli_streaming for each job.
  • events.pyEventHub pub/sub per content-item UUID. ProgressEvent types: phase, progress, wait, log, stderr, done, error.
  • db.py — asyncpg pool, all DB operations (content, queue, rate limits, post log).

Patterns

  • Routes live in routes/ as separate APIRouter instances.
  • Templates are Jinja2 in templates/.
  • Static assets in static/ (CSS, JS).
  • Generated output mounted at /output from settings.output_dir.

Adding a Platform to the Dashboard

  1. Add an entry to PLATFORM_META in cli_runner.py (label, modality, params).
  2. Write generate and publish CommandBuilder functions.
  3. Register them in the BUILDERS dict.
  4. No route changes needed — the generate page auto-discovers from PLATFORM_META.

Database

PostgreSQL via asyncpg. Pool initialized in lifespan, closed on shutdown. MMN_WEB_DATABASE_URL env var required.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 49 lines · 0 tokens per session scan A f4106adc30c6

Subscribe to this mod's changes

web is a cursor rule published in the GitHub repository thearnavrustagi/marketmenow (132 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 499 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.