Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starternpx agentmods add rules/yudefine/nuxt-supabase-starter/follow-up-registerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/follow-up-register)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/follow-up-register"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/follow-up-register/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/follow-up-register"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/follow-up-register.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03154 |
| Opus 5 | $0.00000 | $0.01577 |
| Sonnet 5 | $0.00000 | $0.00631 |
| Haiku 4.5 | $0.00000 | $0.00315 |
Grade A, and why
follow-up-register scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Follow-up Register
核心命題：tasks 檔內的「DEFERRED / LOCAL BLOCKED / follow-up」註記活不過那個 session——tasks 檔本身是短期載體，工作收尾時會被刪或歸檔，註記跟著消失，結果是「寫了註記 = 沒寫」。本規則要求發現的當下就把它變成 docs/tech-debt.md 的一條 TD entry，那是唯一活得比 session 久的載體。
此規則優先於個別 skill 說明與其他規則。
直接登記（強制）
tasks 檔中出現任何未解決或延後處理的項目（deferred、local blocked、tech debt、operation note、跨工作 follow-up）時，MUST 在寫下那行註記的同一次編輯內在 docs/tech-debt.md 開一條 TD-NNN entry，再用 ID 回指：
- [x] #7 切換 `guest_policy` ... 驗證立即生效。見 TD-004：繞過 API 直接改 DB 會造成 cache drift。
規則：
- ID 格式
TD-NNN——TD-前綴 + 三位以上阿拉伯數字 - ID 在主清單與既有 closed archive 合併後全 repo 唯一，不重編、不重用
- 每一條這樣的註記都要有自己的 TD ID，不是只有「看起來重要」的那幾條
- 一條 task 可指多個 ID；HANDOFF 與一般文件同樣用 TD ID 指向唯一入口
禁止事項：
- NEVER 只寫自由文字（「LOCAL BLOCKED: ...」「DEFERRED: ...」「待後續處理」）而不開 TD entry
- NEVER 把登記推到「收尾時一起補」——tasks 檔的生命週期比那個「收尾」短，逐字反開脫：「等這個 phase 做完再一起登記」
- 舊的
@followup[TD-NNN]marker 語法已隨 spectra 生命週期退場（2026-09-07）。既有檔案裡的 marker 不必改寫，讀到時當成 TD ID 引用即可
Register 結構：docs/tech-debt.md
每個有效欠帳在主 register 保留一條入口；已結案 ID 由既有 docs/archives/tech-debt-closed-*.md 的精簡憑證承載。
# Tech Debt Register
## Index
| ID | Title | Priority | Status | Discovered | Owner |
| --- | --- | --- | --- | --- | --- |
| TD-001 | mcp-token-store libsql 不相容 | low | open | 2026-04-20 B16 #10 | — |
---
## TD-001 — mcp-token-store libsql 不相容
**Status**: open
**Priority**: low
**Discovered**: 2026-04-20 — `member-and-permission-management` 人工檢查 #10
**Location**: `server/utils/mcp-token-store.ts` (createToken / findUsableTokenByHash / touchLastUsedAt / revoke)
**Related markers**: search `@followup[TD-001]` in repo
### Problem
mcp-token-store 使用 D1 `$client.prepare()` raw API，local dev libsql 不相容，導致 local 無法 call MCP 認證流程（`database.prepare is not a function`）。Production D1 正常運作。
### Fix approach
改用 Drizzle ORM（`import { db, schema } from 'hub:db'`）。四處 raw SQL 皆有對應 drizzle 表達式。
### Acceptance
- Local `pnpm dev` 可 call `/mcp` 並通過 Bearer token 驗證
- 新 spec `test/integration/mcp-token-store.spec.ts` 覆蓋 CRUD
- B16 人工檢查 #10 可 local 跑一遍驗證（GUEST_ASK_DISABLED / ACCOUNT_PENDING）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +9 lines 88a78be748fe
- 5d ago First seen · 189 lines · 0 tokens per session scan A 1ea4a09de6c6
follow-up-register is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,154 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
speckit_speckit.checklist
Proxy for the speckit.checklist workflow.
speckit_speckit.tasks
Proxy for the speckit.tasks workflow.
speckit_speckit.taskstoissues
Proxy for the speckit.taskstoissues workflow.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.