Home › AI Coding Rules Pack
AI Coding Rules Pack
Battle-tested rules for security, testing, review and git across TypeScript, React/Next.js, Python/FastAPI and Node.
$19 one-time · v1.1.0 · zip, 95 KB
Buy AI Coding Rules Pack: $19Secure checkout by Lemon Squeezy (merchant of record). One-time payment, instant download.
Or get it in the Complete Vibe Coding Toolkit (all four kits for $99).
What's inside
- Always-on core, security and agent-workflow rules, plus file-scoped rules for TypeScript, React/Next.js, Python/FastAPI and Node that load only when relevant.
- Skills / slash commands: /plan-feature, /fix-bug, /review-changes, /commit-work, /security-audit, /write-tests.
- New in 1.1: one source of truth. AGENTS.md holds every rule plus a Decisions log, CLAUDE.md just imports it (
@AGENTS.md), and/record-decisionsappends each session's decisions. - Agent-safe definition of done: never edit or delete tests or assertions to make them pass, never change acceptance criteria, and verify the real user flow.
- Version pinning: detect versions from package.json and lockfiles before writing code, with traps for Tailwind v4, Next.js 16 and Supabase
@supabase/ssrauth. - Local rules near risky code: ready-to-copy
src/authandsrc/billingAGENTS.md examples, with notes on how each tool loads them. - A PLAN.md template and copy-paste session prompts for long agent sessions.
Rules (13)
| Rule | When it applies |
|---|---|
agent-workflow | How the AI agent plans, executes and verifies work in this repository |
code-review | Checklist the agent applies when reviewing or self-reviewing changes before commit |
core | Always-on engineering rules for any language or stack in this repository |
definition-of-done | What "done" means; forbids weakening tests, assertions or acceptance criteria to make work pass |
git-workflow | Branching, commit message and safety rules for git operations |
local-rules | Read and obey module-level AGENTS.md files (auth, billing, migrations) before editing files in those directories |
node | Node.js 20+ server conventions (ESM, errors, config, HTTP, processes) |
python-fastapi | Python 3.11+ typing, FastAPI routing, pydantic validation and pytest conventions |
react-next | React 19 and Next.js App Router conventions for components, routes and server actions |
security | Secrets handling, input validation, authentication/authorization and dependency hygiene rules |
testing | How to write and run tests (Vitest/Jest for TS, pytest for Python) |
typescript | Strict TypeScript conventions for .ts/.tsx files |
version-pinning | Detect exact framework and library versions from manifests and lockfiles before writing code, and use that version's APIs |
Skills and slash commands (7)
| Command | What it does |
|---|---|
/commit-work | Run all checks, then stage and create a Conventional Commits commit for the current work. Only when the user explicitly asks to commit. |
/fix-bug | Diagnose and fix one bug with a regression test, smallest possible change. Use when the user reports a bug, error message, failing test or unexpected behaviour. |
/plan-feature | Plan a single feature before writing code. Writes or updates PLAN.md with goal, files, small steps and done-criteria. Use when starting a new feature or when the user asks for a plan. |
/record-decisions | End-of-session step that appends the decisions made in this session (what, why, alternatives rejected) to the Decisions log in AGENTS.md. Use when the user wraps up a session or asks to record decisions. |
/review-changes | Review the current uncommitted diff or branch for bugs, security issues, missing tests and rule violations before committing. Use when asked to review, check or audit changes. |
/security-audit | Audit the codebase or a diff for secrets, missing input validation, missing authorization, injection, unsafe dependencies and insecure config. Use when asked for a security review or before a release. |
/write-tests | Write focused, deterministic tests for a given module or behaviour following the project's test framework. Use when asked to add tests or increase coverage for specific code. |
Every tool, native format
- Cursor:
.cursor/rules/*.mdcwith description/globs/alwaysApply frontmatter. Workflows ship as manual @rules. - Claude Code: a thin
CLAUDE.mdthat imports the sharedAGENTS.mdwith@AGENTS.md, plus.claude/skills/*/SKILL.mdslash commands. - Codex:
AGENTS.md(well under the 32 KiB default cap) with a Decisions log, and.agents/skills. - Windsurf:
.windsurf/ruleswith trigger frontmatter (each file under 12,000 characters) and.windsurf/workflows. - GitHub Copilot:
.github/copilot-instructions.md,.github/instructions/*.instructions.mdwith applyTo, and.github/prompts/*.prompt.md.
Every file is generated from one master source and checked by a format validator, so the five versions never drift apart. In your repo, AGENTS.md is the one file to edit: Codex, Cursor, Windsurf and Copilot read it, and Claude Code imports it. Why one source of truth.
Install
Unzip, then copy your tool's folder to the project root. See the docs for your tool.