Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/tomasz-tomczyk/crit/frontend-jsgit clone --depth 1 https://github.com/tomasz-tomczyk/critWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00516 |
| Opus 5 | $0.00000 | $0.00258 |
| Sonnet 5 | $0.00000 | $0.00103 |
| Haiku 4.5 | $0.00000 | $0.00052 |
Grade A, and why
frontend-js scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 34 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Frontend JS Rules (semantic — ESLint handles syntax/style)
DOM & Events
- Use
addEventListener, not inlineonclickhandlers in new code. - Cache repeated DOM queries into const variables.
State Management
- When async operations can be triggered from multiple sources, add dedup guards (e.g.,
reloadInFlightpromise pattern). - Reset ALL navigation/UI state when context changes (scope change, session reload, comment delete).
- When implementing UI state logic that counts comments, account for ALL comment types (file-scoped AND review-level).
Persisted Settings (cookies, not localStorage)
- Use cookies for any setting that should persist across
critinvocations. Crit defaults to a random port (port=0), and localStorage is scoped per origin (scheme + host + port), so localStorage settings reset every run. Cookies are host-scoped and survive port changes. - Persisted settings live in a single
crit-settingsJSON cookie viagetSetting(key, fallback)/setSetting(key, value). The exception iscrit-templates, which stays in its own cookie because it's user-defined and can be longer. - localStorage is fine for transient per-session data (e.g.,
crit-draft-*autosave keys that are review-specific anyway). - Before adding persistence to a setting, ask whether it should be sticky. Transient view state (active filter, sort order on a list) usually shouldn't be — users coming back to a new review with "resolved-only" active would miss new open comments. Persist preferences (theme, width, hide-resolved), not transient views.
Error Handling
- Always check
response.okafterfetch()calls. Throw on unexpected statuses. - Every async operation must have error recovery that restores interactivity (re-attach listeners, undo optimistic UI).
- Never call
.remove()directly on elements with CSS exit animations. Use class toggle + animationend listener.
Accessibility (axe-core in E2E catches missing aria-labels, dialog roles, tab roles)
- Never call
.blur()on interactive elements — it breaks keyboard navigation. axe-core catches the effect (no focus indicator) but not the cause.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 34 lines · 0 tokens per session scan A 2feeb9b79da7
frontend-js is a cursor rule published in the GitHub repository tomasz-tomczyk/crit (979 stars, last pushed 4d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 516 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
cursorrules
Este repo usa Knowledge-Driven Development (KDD). Las reglas completas para cualquier agente de IA (incluido Cursor) estan en .agents/AGENTS.md — leelo antes de escribir codigo.
002-verify-before-act
Requires Claude to read before writing, verify before installing, and confirm before destructive operations.
clarify-first-prompting
Clarify-first strategy: detect ambiguity, ask targeted questions, expand simple prompts into detailed specifications.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.