Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starternpx agentmods add rules/yudefine/nuxt-supabase-starter/code-style.toolchainWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/code-style.toolchain)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/code-style.toolchain"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/code-style.toolchain/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/code-style.toolchain"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/code-style.toolchain.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.13786 | $0.13786 |
| Opus 5 | $0.06893 | $0.06893 |
| Sonnet 5 | $0.02757 | $0.02757 |
| Haiku 4.5 | $0.01379 | $0.01379 |
Grade D, and why
code-style.toolchain scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
clade 投影進 consumer 的路徑(`vendor/**`、`.claude/**`、`.clade/**`、`.spectra/**`)在 consumer 端是 `chmod 444` 的 LOCKED 副本。**consumer 修不了裡面的 lint / fmt 違規** —— 修法只能回 clade 改源檔再 propagate。 Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf node_modules && pnpm install # 這次才會真的 resolve 並改寫 lockfile How it starts
The opening of the file, as written. The whole thing — 675 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Style — 工具鏈治理
本檔是 [[code-style]] 的工具鏈半邊。 主檔留「寫 code 當下」適用的部分(新增腳本一律
TypeScript 的三條語法限制、用 vp 命令驗證),本檔收所有只可能在編輯設定檔時被違反的條文。
為什麼拆(2026-08-02,AI Agent 實測):code-style.md 原本 27.3 KB、paths: 吃全 repo 的
.{js,ts,vue,jsx,tsx,mjs,cjs,mts,cts,json}——任何一次原始碼編輯都讓整份進場,進場後被該
session 後續每個 request 重讀。7 天全 fleet 注入 83 次,約 1.03M tokens,佔 nested_memory
總量 12%,是所有條件式規約的第一名。
而本檔這 23 KB 的每一條,違規都只可能發生在上面 paths: 列的那些檔:NEVER 建立 .eslintrc 只能在寫 .eslintrc* 時違反、CI workflow 禁止跑 vp check 只能在寫
.github/workflows/** 時違反。這些路徑界定正文的適用範圍,各 runtime adapter 依實際載入契約交付;
上述注入次數與 cache-read 是當次 AI Agent 的量測,不外推其他產品。這個對應關係是拆分的依據——
與 docs/tech-debt.md TD-328 那次失敗的分層不同型(那次搬走的是「說服力」,沒有這種對應關係)。
改本檔 paths: 前先確認新增的副檔名 / 路徑在本檔內真的有對應條文。 2026-08-02 曾因為
glob 掛著 md 而讓編輯 markdown 也拉進整份規約(該規約自己的 fmt ignorePatterns 就寫著
'**/*.md')——glob 寬一格的成本不是零,機械稽核見 scripts/audit-rule-paths.ts 的
over-broad-glob。
核心命題:本治理範圍下所有 JS/TS 專案一律使用 vite-plus(vp)內建的 oxc 工具鏈:oxfmt(formatter)+ oxlint(linter)。禁止任何 eslint / prettier 設定檔。
理由:
oxc用 Rust 寫的,比 prettier/eslint 快 10–100 倍vp已 batteries-included,不需要額外裝 / 維護兩套生態系- 統一工具鏈避免 consumer 之間 lint rule drift
Governance — lint / fmt 設定改在哪
跨 consumer 統一的 baseline(oxlint rules / oxfmt 風格 / 共用 ignore patterns)MUST 改在 clade 中央倉 vendor/oxc-shared/preset.ts,再 node scripts/publish.ts <bump> && node scripts/propagate.ts 散播到所有 consumer。NEVER 在 consumer 端的 vendor/oxc-shared/preset.ts 投影副本直接改 — 下次 propagate 會覆蓋,且各 consumer 會 silently drift。
consumer 自家業務 override(單一 consumer 因第三方套件需要關掉某條 rule、或自家業務需要加 ignore path)寫在該 consumer 的 vite.config.ts 內、spread baseline 之後的 override block,禁止整段 inline 重寫 baseline(會 silently drift)。範例見下方 § vite.config.ts 必備欄位。
判斷流程:
- 「這條規則 / 風格 / ignore 是否每個 consumer 都該套?」
- 是 → clade
vendor/oxc-shared/preset.ts(baseline) - 否,只有單一 consumer 需要 → 該 consumer 自家
vite.config.tsoverride block
- 是 → clade
- 不確定 → 預設放 clade baseline(過鬆比過嚴容易補;先散播再個別 override 比反向收斂容易)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +14 lines · +505 tokens per session 1a3ead2ce820
- 6d ago First seen · 661 lines · 13,281 tokens per session scan D 9ec600a79466
code-style.toolchain is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It adds 13,786 tokens to every session, about $0.0689 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
functions
Rules for writing TypeScript functions.
bun-runtime
Bun runtime patterns and best practices.
create-github-action
ROLE: You are an advanced code-generating LLM tasked with creating a reusable, well-tested, production-ready GitHub Action (and its supporting workflows) using Deno 2.
typescript
You are an expert in building MCP servers in TypeScript using a test-driven design methodology.
vitest-expect-typeof
The toMatchTypeOf() matcher has been deprecated in Vitest's expectTypeOf API.
ts
A set of TypeScript coding rules covering types, naming, file organization, error handling, and strict type checking. TypeScript is JavaScript with checks that help catch many mistakes before the program runs.