Two files, one repository

ivangrynenko/cursorrules ships 3 formats across 40 indexed files. The question worth asking is whether the second one says anything the first does not.

CompareAGENTS.md ↔ CLAUDE.md AGENTS.md ↔ Cursor rules CLAUDE.md ↔ Cursor rules

A · AGENTS.md · 527 words B · CLAUDE.md · 976 words

What each file covers, counted
Dimension	Shared	Only in A	Only in B	Overlap
Sections	0	12	30	0%
Commands	0	0	8	0%
Section tags	4	1	5	40%

What each file covers

Sections

0 shared · 12 only in A · 30 only in B

− Cursor Agents Guide (Using Cursor Rules)
− How To Use With Cursor
− Installation Options
− Rule Bundles (Source of Truth)
− Core
− Web Stack
− Python
− JavaScript Security
− Tag-Based Selection
− Maintainer Checklist
− Updating Or Removing
− References
+ CLAUDE.md
+ Project Overview
+ Common Development Tasks
+ Running Tests
+ Run all tests
+ Run individual test scripts
+ Testing the Installer
+ Test installation interactively
+ Test with specific options
+ Test with debug mode
+ Test installation to custom directory
+ Test installation via curl (non-interactive)
+ Linting and Code Quality
+ Architecture and Code Structure
+ Project Organization
+ Rule Categories
+ Key Design Patterns
+ Installation Flow
+ Versioning System
+ Version Management
+ .cursor/UPDATE.md File Purpose
+ Known Issues and Solutions
+ Curl Piping Issues (Fixed in v1.0.6)
+ Testing Coverage Gaps
+ Important Considerations
+ When Adding New Rules
+ When Modifying the Installer
+ Testing Guidelines
+ Security Considerations
+ Contributing

Commands

0 shared · 0 only in A · 8 only in B

+ php install.php
+ php install.php --core
+ php install.php --web-stack
+ php install.php --python
+ php install.php --all
+ php install.php --debug --core
+ php install.php --all --destination=my/custom/path
+ php -l install.php

Section tags

4 shared · 1 only in A · 5 only in B

− build
+ test
+ code-style
+ architecture
+ testing-strategy
+ deployment
git-pr
security
do-not
agent-behaviour

Line diff

+162 added−111 removed16 unchanged9.0% identical

ivangrynenko/cursorrules · AGENTS.md

@@ −1 @@

1# Cursor Agents Guide (Using Cursor Rules)

3This document explains how to use the rules in this repository with Cursor and serves as a single entry point that references the existing rule files. It avoids duplication by linking directly to the `.cursor/rules/*.mdc` sources.

5If you installed these rules via the installer, a project‑local AGENTS.md can be generated that lists only the rules you chose. By default, the installer writes AGENTS.md if absent; it overwrites only when you pass `--yes`.

7## How To Use With Cursor

8- Open your project in Cursor. Rules under `.cursor/rules` are discovered automatically by Cursor.

9- Keep this AGENTS.md handy as your quick index to the rule set.

10- For installation methods and advanced options, see `README.md`.

12## Installation Options

13For full installation details and examples, see `README.md`.

14- Core rules only: `--core`

15- Web stack (includes core): `--web-stack` or `--ws`

16- Python (includes core): `--python`

17- JavaScript security (includes core): `--javascript`

18- All rules: `--all`

19- Tag-based selection: `--tags "<expression>"` or `--tag-preset <name>`

20- Ignore files control: `--ignore-files yes|no|ask`

22Tag taxonomy is documented in `TAG_STANDARDS.md`.

24## Rule Bundles (Source of Truth)

25Below are the rule bundles and their rule files. Each item links directly to the authoritative file under `.cursor/rules/`.

27### Core

28- [.cursor/rules/cursor-rules.mdc](.cursor/rules/cursor-rules.mdc)

29- [.cursor/rules/git-commit-standards.mdc](.cursor/rules/git-commit-standards.mdc)

30- [.cursor/rules/github-actions-standards.mdc](.cursor/rules/github-actions-standards.mdc)

31- [.cursor/rules/improve-cursorrules-efficiency.mdc](.cursor/rules/improve-cursorrules-efficiency.mdc)

32- [.cursor/rules/pull-request-changelist-instructions.mdc](.cursor/rules/pull-request-changelist-instructions.mdc)

33- [.cursor/rules/readme-maintenance-standards.mdc](.cursor/rules/readme-maintenance-standards.mdc)

34- [.cursor/rules/testing-guidelines.mdc](.cursor/rules/testing-guidelines.mdc)

35 - [.cursor/rules/confluence-editing-standards.mdc](.cursor/rules/confluence-editing-standards.mdc)

37### Web Stack

38- [.cursor/rules/accessibility-standards.mdc](.cursor/rules/accessibility-standards.mdc)

39- [.cursor/rules/api-standards.mdc](.cursor/rules/api-standards.mdc)

40- [.cursor/rules/build-optimization.mdc](.cursor/rules/build-optimization.mdc)

41- [.cursor/rules/code-generation-standards.mdc](.cursor/rules/code-generation-standards.mdc)

42- [.cursor/rules/debugging-standards.mdc](.cursor/rules/debugging-standards.mdc)

43- [.cursor/rules/docker-compose-standards.mdc](.cursor/rules/docker-compose-standards.mdc)

44- [.cursor/rules/drupal-authentication-failures.mdc](.cursor/rules/drupal-authentication-failures.mdc)

45- [.cursor/rules/drupal-broken-access-control.mdc](.cursor/rules/drupal-broken-access-control.mdc)

46- [.cursor/rules/drupal-cryptographic-failures.mdc](.cursor/rules/drupal-cryptographic-failures.mdc)

47- [.cursor/rules/drupal-database-standards.mdc](.cursor/rules/drupal-database-standards.mdc)

48- [.cursor/rules/drupal-file-permissions.mdc](.cursor/rules/drupal-file-permissions.mdc)

49- [.cursor/rules/drupal-injection.mdc](.cursor/rules/drupal-injection.mdc)

50- [.cursor/rules/drupal-insecure-design.mdc](.cursor/rules/drupal-insecure-design.mdc)

51- [.cursor/rules/drupal-integrity-failures.mdc](.cursor/rules/drupal-integrity-failures.mdc)

52- [.cursor/rules/drupal-logging-failures.mdc](.cursor/rules/drupal-logging-failures.mdc)

53- [.cursor/rules/drupal-security-misconfiguration.mdc](.cursor/rules/drupal-security-misconfiguration.mdc)

54- [.cursor/rules/drupal-ssrf.mdc](.cursor/rules/drupal-ssrf.mdc)

55- [.cursor/rules/drupal-vulnerable-components.mdc](.cursor/rules/drupal-vulnerable-components.mdc)

56- [.cursor/rules/generic_bash_style.mdc](.cursor/rules/generic_bash_style.mdc)

57- [.cursor/rules/javascript-performance.mdc](.cursor/rules/javascript-performance.mdc)

58- [.cursor/rules/javascript-standards.mdc](.cursor/rules/javascript-standards.mdc)

59- [.cursor/rules/lagoon-docker-compose-standards.mdc](.cursor/rules/lagoon-docker-compose-standards.mdc)

60- [.cursor/rules/lagoon-yml-standards.mdc](.cursor/rules/lagoon-yml-standards.mdc)

61- [.cursor/rules/multi-agent-coordination.mdc](.cursor/rules/multi-agent-coordination.mdc)

62- [.cursor/rules/node-dependencies.mdc](.cursor/rules/node-dependencies.mdc)

63- [.cursor/rules/php-drupal-best-practices.mdc](.cursor/rules/php-drupal-best-practices.mdc)

64- [.cursor/rules/php-drupal-development-standards.mdc](.cursor/rules/php-drupal-development-standards.mdc)

65- [.cursor/rules/php-memory-optimisation.mdc](.cursor/rules/php-memory-optimisation.mdc)

66- [.cursor/rules/project-definition-template.mdc](.cursor/rules/project-definition-template.mdc)

67- [.cursor/rules/react-patterns.mdc](.cursor/rules/react-patterns.mdc)

68- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)

69- [.cursor/rules/secret-detection.mdc](.cursor/rules/secret-detection.mdc)

70- [.cursor/rules/tailwind-standards.mdc](.cursor/rules/tailwind-standards.mdc)

71- [.cursor/rules/tests-documentation-maintenance.mdc](.cursor/rules/tests-documentation-maintenance.mdc)

72- [.cursor/rules/third-party-integration.mdc](.cursor/rules/third-party-integration.mdc)

73- [.cursor/rules/vortex-cicd-standards.mdc](.cursor/rules/vortex-cicd-standards.mdc)

74- [.cursor/rules/vortex-scaffold-standards.mdc](.cursor/rules/vortex-scaffold-standards.mdc)

75- [.cursor/rules/vue-best-practices.mdc](.cursor/rules/vue-best-practices.mdc)

76- [.cursor/rules/behat-steps.mdc](.cursor/rules/behat-steps.mdc)

77- [.cursor/rules/behat-ai-guide.mdc](.cursor/rules/behat-ai-guide.mdc)

79### Python

80- [.cursor/rules/python-authentication-failures.mdc](.cursor/rules/python-authentication-failures.mdc)

81- [.cursor/rules/python-broken-access-control.mdc](.cursor/rules/python-broken-access-control.mdc)

82- [.cursor/rules/python-cryptographic-failures.mdc](.cursor/rules/python-cryptographic-failures.mdc)

83- [.cursor/rules/python-injection.mdc](.cursor/rules/python-injection.mdc)

84- [.cursor/rules/python-insecure-design.mdc](.cursor/rules/python-insecure-design.mdc)

85- [.cursor/rules/python-integrity-failures.mdc](.cursor/rules/python-integrity-failures.mdc)

86- [.cursor/rules/python-logging-monitoring-failures.mdc](.cursor/rules/python-logging-monitoring-failures.mdc)

87- [.cursor/rules/python-security-misconfiguration.mdc](.cursor/rules/python-security-misconfiguration.mdc)

88- [.cursor/rules/python-ssrf.mdc](.cursor/rules/python-ssrf.mdc)

89- [.cursor/rules/python-vulnerable-outdated-components.mdc](.cursor/rules/python-vulnerable-outdated-components.mdc)

90- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)

92### JavaScript Security

93- [.cursor/rules/javascript-broken-access-control.mdc](.cursor/rules/javascript-broken-access-control.mdc)

94- [.cursor/rules/javascript-cryptographic-failures.mdc](.cursor/rules/javascript-cryptographic-failures.mdc)

95- [.cursor/rules/javascript-identification-authentication-failures.mdc](.cursor/rules/javascript-identification-authentication-failures.mdc)

96- [.cursor/rules/javascript-injection.mdc](.cursor/rules/javascript-injection.mdc)

97- [.cursor/rules/javascript-insecure-design.mdc](.cursor/rules/javascript-insecure-design.mdc)

98- [.cursor/rules/javascript-security-logging-monitoring-failures.mdc](.cursor/rules/javascript-security-logging-monitoring-failures.mdc)

99- [.cursor/rules/javascript-security-misconfiguration.mdc](.cursor/rules/javascript-security-misconfiguration.mdc)

100- [.cursor/rules/javascript-server-side-request-forgery.mdc](.cursor/rules/javascript-server-side-request-forgery.mdc)

101- [.cursor/rules/javascript-software-data-integrity-failures.mdc](.cursor/rules/javascript-software-data-integrity-failures.mdc)

102- [.cursor/rules/javascript-vulnerable-outdated-components.mdc](.cursor/rules/javascript-vulnerable-outdated-components.mdc)

103

104## Tag-Based Selection

105The installer supports tag expressions and presets. Examples:

106- `--tags "language:javascript category:security"`

107- `--tags "framework:react"`

108- `--tags "language:php standard:owasp-top10"`

109- `--tag-preset js-owasp`

110

111See `TAG_STANDARDS.md` for the complete tag taxonomy and guidance.

112

113## Maintainer Checklist

114- Before opening a pull request, prepend a new entry to `CHANGELOG.md` describing your changes (latest release first) and never delete prior history.

115- Ensure the summary in `CHANGELOG.md` matches the work being done and that `CURSOR_RULES_VERSION` reflects the next release number.

116- Record key implementation notes in this `AGENTS.md` only when they affect installer behaviour or rule coverage so the instructions stay current.

117- Regenerate project-local `AGENTS.md` files with `--yes` when you need to refresh them after significant rule or command updates.

118

119## Updating Or Removing

120- To update, re-run the installer with your preferred options (it will copy over updated rules). See `README.md`.

121- To remove rules, delete files from `.cursor/rules` and remove any generated `.cursorignore` files if not needed.

122

123## References

124- Project README: [README.md](README.md)

125- Tag standards: [TAG_STANDARDS.md](TAG_STANDARDS.md)

126- All rule sources: `.cursor/rules/*.mdc`

127

ivangrynenko/cursorrules · CLAUDE.md

@@ +1 @@

1# CLAUDE.md

3This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

5## Project Overview

7This is a repository for managing and distributing Cursor AI rules, particularly focused on web development with strong emphasis on PHP/Drupal, frontend frameworks, and security best practices. The project provides an interactive PHP installer that allows developers to selectively install rule sets into their projects.

9## Common Development Tasks

11### Running Tests

12```bash

13# Run all tests

14cd .tests && ./run-all-tests.sh

16# Run individual test scripts

17cd .tests

18./test-copy.sh # Test basic installation functionality

19./test-debug.sh # Test debug mode

20./test-invalid-option.sh # Test invalid option handling

21./test-conflicting-options.sh # Test conflicting options

22./test-missing-files.sh # Test missing file handling

23```

25### Testing the Installer

26```bash

27# Test installation interactively

28php install.php

30# Test with specific options

31php install.php --core # Install core rules only

32php install.php --web-stack # Install web stack rules (includes core)

33php install.php --python # Install Python rules (includes core)

34php install.php --all # Install all rules

36# Test with debug mode

37php install.php --debug --core

39# Test installation to custom directory

40php install.php --all --destination=my/custom/path

42# Test installation via curl (non-interactive)

43curl -s https://raw.githubusercontent.com/ivangrynenko/cursor-rules/main/install.php | php -- --ws

44cat install.php | php -- --core # Test piped input locally

45```

47### Linting and Code Quality

48- PHP syntax validation: `php -l install.php`

49- No specific linting commands configured - consider adding phpcs/phpmd

51## Architecture and Code Structure

53### Project Organization

54- **install.php**: Main installer script (current version defined by CURSOR_RULES_VERSION constant)

55- **.cursor/rules/**: Contains 56 MDC rule files organized by category

56- **.cursor/UPDATE.md**: Installation receipt file tracking installed version and configuration (created by installer)

57- **.tests/**: Bash test scripts for installer validation

58- **.github/workflows/**: CI/CD pipeline using GitHub Actions for PHP 8.3

59- **AGENTS.md**: Comprehensive guide for using Cursor Rules (created by installer)

61### Rule Categories

621. **Core Rules** (7 files): Git standards, testing guidelines, README maintenance

632. **Web Development Rules**:

64 - Frontend: JavaScript, React, Vue, Tailwind, accessibility

65 - Backend: PHP/Drupal standards, database

66 - Security: OWASP Top 10 implementations for Drupal

67 - DevOps: Docker, Lagoon, Vortex configurations

683. **Python Rules** (10 files): Security-focused rules following OWASP standards

70### Key Design Patterns

71- **Installer Architecture**:

72 - Stateless design - each execution is independent

73 - Builder pattern for rule set construction

74 - Strategy pattern for interactive vs non-interactive modes

75 - Factory pattern for rule set management

77### Installation Flow

781. User executes install.php (directly or via curl)

792. Script detects if running interactively or with parameters

803. Creates .cursor/rules directory structure

814. Downloads and installs selected rule files from GitHub

825. Creates/overwrites .cursor/UPDATE.md file as an installation receipt

836. Creates/updates AGENTS.md documentation (unless --yes flag overwrites)

85## Versioning System

87### Version Management

88- **Version Constant**: Defined in install.php as `CURSOR_RULES_VERSION`

89- **Version History**: Tracked in GitHub releases and repository documentation

90- **Release Process**:

91 1. Update CURSOR_RULES_VERSION constant in install.php

92 2. Update version history in repository documentation

93 3. Create GitHub release matching the version number

94 4. Tag the release in git

96### .cursor/UPDATE.md File Purpose

97The UPDATE.md file serves as an installation receipt that:

98- Records the version of cursor-rules that was installed

99- Documents the installation date and time

100- Lists the number of rule files installed

101- Shows the installation type (core, web-stack, Python, etc.)

102- Records any tag filters that were applied

103- Gets created/overwritten by the installer on each run

104- Helps users identify which version and configuration they have installed

105

106## Known Issues and Solutions

107

108### Curl Piping Issues (Fixed in v1.0.6)

109When piping the installer through curl, several PHP-specific behaviors can cause problems:

110

111**Problem**: Script hangs when using `curl ... | php` commands

112**Root Causes**:

1131. `$_SERVER['PHP_SELF']` becomes "Standard input code" instead of script name when piped

1142. PHP continues waiting for STDIN input even after script completion

1153. Arguments may not parse correctly when using `--` separator with piped input

116

117**Solutions Implemented**:

1181. **Entry Point Detection**: Check for both normal execution and "Standard input code"

119 ```php

120 if (basename(__FILE__) === basename($_SERVER['PHP_SELF'] ?? '') ||

121 ($_SERVER['PHP_SELF'] ?? '') === 'Standard input code')

122 ```

123

1242. **STDIN Cleanup**: Always close STDIN before exit to prevent hanging

125 ```php

126 if (defined('STDIN') && is_resource(STDIN)) {

127 fclose(STDIN);

128 }

129 ```

130

1313. **Argument Parsing**: Handle both with and without `--` separator

132 ```php

133 if (!stream_isatty(STDIN) && $_SERVER['PHP_SELF'] === 'Standard input code') {

134 // Parse arguments from argv when piped

135 }

136 ```

137

138### Testing Coverage Gaps

139**Issue**: Test suite only covered direct PHP execution, not curl piping scenarios

140**Recommendation**: Add tests for:

141- `curl ... | php` execution paths

142- `cat install.php | php` scenarios

143- Argument parsing with and without `--` separator

144- STDIN handling in different contexts

145

146## Important Considerations

147

148### When Adding New Rules

149- Follow MDC format (Markdown with custom rule syntax)

150- Place in appropriate category under .cursor/rules/

151- Update the rule arrays in install.php (core_rules, web_stack_rules, python_rules)

152- Add rule to README.md documentation table

153- Consider rule dependencies (e.g., web stack includes core rules)

154

155### When Modifying the Installer

156- Maintain PHP 8.3+ compatibility

157- Preserve both interactive and non-interactive modes

158- Update CURSOR_RULES_VERSION constant when making changes

159- Ensure all tests pass before committing

160- Test with both local files and GitHub downloads

161

162### Testing Guidelines

163- All tests are bash scripts in .tests/ directory

164- Tests use temporary directories to avoid affecting the actual installation

165- Each test should output clear success/failure messages

166- GitHub Actions runs all tests on push/PR to main branch

167

168## Security Considerations

169- Never commit sensitive information or API keys

170- Rule files should not contain hardcoded credentials

171- Installer validates file permissions and directory creation

172- Downloaded files are fetched over HTTPS from GitHub

173

174## Contributing

175- Follow conventional commits format (fix:, feat:, docs:, etc.)

176- Update relevant documentation when adding features

177- Ensure all tests pass before submitting PR

178- New rules should include clear descriptions and examples

@@ −1 +1 @@

1−# Cursor Agents Guide (Using Cursor Rules)

1+# CLAUDE.md

3−This document explains how to use the rules in this repository with Cursor and serves as a single entry point that references the existing rule files. It avoids duplication by linking directly to the `.cursor/rules/*.mdc` sources.

3+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

5−If you installed these rules via the installer, a project‑local AGENTS.md can be generated that lists only the rules you chose. By default, the installer writes AGENTS.md if absent; it overwrites only when you pass `--yes`.

5+## Project Overview

7−## How To Use With Cursor

8−- Open your project in Cursor. Rules under `.cursor/rules` are discovered automatically by Cursor.

9−- Keep this AGENTS.md handy as your quick index to the rule set.

10−- For installation methods and advanced options, see `README.md`.

7+This is a repository for managing and distributing Cursor AI rules, particularly focused on web development with strong emphasis on PHP/Drupal, frontend frameworks, and security best practices. The project provides an interactive PHP installer that allows developers to selectively install rule sets into their projects.

118

12−## Installation Options

13−For full installation details and examples, see `README.md`.

14−- Core rules only: `--core`

15−- Web stack (includes core): `--web-stack` or `--ws`

16−- Python (includes core): `--python`

17−- JavaScript security (includes core): `--javascript`

18−- All rules: `--all`

19−- Tag-based selection: `--tags "<expression>"` or `--tag-preset <name>`

20−- Ignore files control: `--ignore-files yes|no|ask`

9+## Common Development Tasks

2110

22−Tag taxonomy is documented in `TAG_STANDARDS.md`.

11+### Running Tests

12+```bash

13+# Run all tests

14+cd .tests && ./run-all-tests.sh

2315

24−## Rule Bundles (Source of Truth)

25−Below are the rule bundles and their rule files. Each item links directly to the authoritative file under `.cursor/rules/`.

16+# Run individual test scripts

17+cd .tests

18+./test-copy.sh # Test basic installation functionality

19+./test-debug.sh # Test debug mode

20+./test-invalid-option.sh # Test invalid option handling

21+./test-conflicting-options.sh # Test conflicting options

22+./test-missing-files.sh # Test missing file handling

23+```

2624

27−### Core

28−- [.cursor/rules/cursor-rules.mdc](.cursor/rules/cursor-rules.mdc)

29−- [.cursor/rules/git-commit-standards.mdc](.cursor/rules/git-commit-standards.mdc)

30−- [.cursor/rules/github-actions-standards.mdc](.cursor/rules/github-actions-standards.mdc)

31−- [.cursor/rules/improve-cursorrules-efficiency.mdc](.cursor/rules/improve-cursorrules-efficiency.mdc)

32−- [.cursor/rules/pull-request-changelist-instructions.mdc](.cursor/rules/pull-request-changelist-instructions.mdc)

33−- [.cursor/rules/readme-maintenance-standards.mdc](.cursor/rules/readme-maintenance-standards.mdc)

34−- [.cursor/rules/testing-guidelines.mdc](.cursor/rules/testing-guidelines.mdc)

35− - [.cursor/rules/confluence-editing-standards.mdc](.cursor/rules/confluence-editing-standards.mdc)

25+### Testing the Installer

26+```bash

27+# Test installation interactively

28+php install.php

3629

37−### Web Stack

38−- [.cursor/rules/accessibility-standards.mdc](.cursor/rules/accessibility-standards.mdc)

39−- [.cursor/rules/api-standards.mdc](.cursor/rules/api-standards.mdc)

40−- [.cursor/rules/build-optimization.mdc](.cursor/rules/build-optimization.mdc)

41−- [.cursor/rules/code-generation-standards.mdc](.cursor/rules/code-generation-standards.mdc)

42−- [.cursor/rules/debugging-standards.mdc](.cursor/rules/debugging-standards.mdc)

43−- [.cursor/rules/docker-compose-standards.mdc](.cursor/rules/docker-compose-standards.mdc)

44−- [.cursor/rules/drupal-authentication-failures.mdc](.cursor/rules/drupal-authentication-failures.mdc)

45−- [.cursor/rules/drupal-broken-access-control.mdc](.cursor/rules/drupal-broken-access-control.mdc)

46−- [.cursor/rules/drupal-cryptographic-failures.mdc](.cursor/rules/drupal-cryptographic-failures.mdc)

47−- [.cursor/rules/drupal-database-standards.mdc](.cursor/rules/drupal-database-standards.mdc)

48−- [.cursor/rules/drupal-file-permissions.mdc](.cursor/rules/drupal-file-permissions.mdc)

49−- [.cursor/rules/drupal-injection.mdc](.cursor/rules/drupal-injection.mdc)

50−- [.cursor/rules/drupal-insecure-design.mdc](.cursor/rules/drupal-insecure-design.mdc)

51−- [.cursor/rules/drupal-integrity-failures.mdc](.cursor/rules/drupal-integrity-failures.mdc)

52−- [.cursor/rules/drupal-logging-failures.mdc](.cursor/rules/drupal-logging-failures.mdc)

53−- [.cursor/rules/drupal-security-misconfiguration.mdc](.cursor/rules/drupal-security-misconfiguration.mdc)

54−- [.cursor/rules/drupal-ssrf.mdc](.cursor/rules/drupal-ssrf.mdc)

55−- [.cursor/rules/drupal-vulnerable-components.mdc](.cursor/rules/drupal-vulnerable-components.mdc)

56−- [.cursor/rules/generic_bash_style.mdc](.cursor/rules/generic_bash_style.mdc)

57−- [.cursor/rules/javascript-performance.mdc](.cursor/rules/javascript-performance.mdc)

58−- [.cursor/rules/javascript-standards.mdc](.cursor/rules/javascript-standards.mdc)

59−- [.cursor/rules/lagoon-docker-compose-standards.mdc](.cursor/rules/lagoon-docker-compose-standards.mdc)

60−- [.cursor/rules/lagoon-yml-standards.mdc](.cursor/rules/lagoon-yml-standards.mdc)

61−- [.cursor/rules/multi-agent-coordination.mdc](.cursor/rules/multi-agent-coordination.mdc)

62−- [.cursor/rules/node-dependencies.mdc](.cursor/rules/node-dependencies.mdc)

63−- [.cursor/rules/php-drupal-best-practices.mdc](.cursor/rules/php-drupal-best-practices.mdc)

64−- [.cursor/rules/php-drupal-development-standards.mdc](.cursor/rules/php-drupal-development-standards.mdc)

65−- [.cursor/rules/php-memory-optimisation.mdc](.cursor/rules/php-memory-optimisation.mdc)

66−- [.cursor/rules/project-definition-template.mdc](.cursor/rules/project-definition-template.mdc)

67−- [.cursor/rules/react-patterns.mdc](.cursor/rules/react-patterns.mdc)

68−- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)

69−- [.cursor/rules/secret-detection.mdc](.cursor/rules/secret-detection.mdc)

70−- [.cursor/rules/tailwind-standards.mdc](.cursor/rules/tailwind-standards.mdc)

71−- [.cursor/rules/tests-documentation-maintenance.mdc](.cursor/rules/tests-documentation-maintenance.mdc)

72−- [.cursor/rules/third-party-integration.mdc](.cursor/rules/third-party-integration.mdc)

73−- [.cursor/rules/vortex-cicd-standards.mdc](.cursor/rules/vortex-cicd-standards.mdc)

74−- [.cursor/rules/vortex-scaffold-standards.mdc](.cursor/rules/vortex-scaffold-standards.mdc)

75−- [.cursor/rules/vue-best-practices.mdc](.cursor/rules/vue-best-practices.mdc)

76−- [.cursor/rules/behat-steps.mdc](.cursor/rules/behat-steps.mdc)

77−- [.cursor/rules/behat-ai-guide.mdc](.cursor/rules/behat-ai-guide.mdc)

30+# Test with specific options

31+php install.php --core # Install core rules only

32+php install.php --web-stack # Install web stack rules (includes core)

33+php install.php --python # Install Python rules (includes core)

34+php install.php --all # Install all rules

7835

79−### Python

80−- [.cursor/rules/python-authentication-failures.mdc](.cursor/rules/python-authentication-failures.mdc)

81−- [.cursor/rules/python-broken-access-control.mdc](.cursor/rules/python-broken-access-control.mdc)

82−- [.cursor/rules/python-cryptographic-failures.mdc](.cursor/rules/python-cryptographic-failures.mdc)

83−- [.cursor/rules/python-injection.mdc](.cursor/rules/python-injection.mdc)

84−- [.cursor/rules/python-insecure-design.mdc](.cursor/rules/python-insecure-design.mdc)

85−- [.cursor/rules/python-integrity-failures.mdc](.cursor/rules/python-integrity-failures.mdc)

86−- [.cursor/rules/python-logging-monitoring-failures.mdc](.cursor/rules/python-logging-monitoring-failures.mdc)

87−- [.cursor/rules/python-security-misconfiguration.mdc](.cursor/rules/python-security-misconfiguration.mdc)

88−- [.cursor/rules/python-ssrf.mdc](.cursor/rules/python-ssrf.mdc)

89−- [.cursor/rules/python-vulnerable-outdated-components.mdc](.cursor/rules/python-vulnerable-outdated-components.mdc)

90−- [.cursor/rules/security-practices.mdc](.cursor/rules/security-practices.mdc)

36+# Test with debug mode

37+php install.php --debug --core

9138

92−### JavaScript Security

93−- [.cursor/rules/javascript-broken-access-control.mdc](.cursor/rules/javascript-broken-access-control.mdc)

94−- [.cursor/rules/javascript-cryptographic-failures.mdc](.cursor/rules/javascript-cryptographic-failures.mdc)

95−- [.cursor/rules/javascript-identification-authentication-failures.mdc](.cursor/rules/javascript-identification-authentication-failures.mdc)

96−- [.cursor/rules/javascript-injection.mdc](.cursor/rules/javascript-injection.mdc)

97−- [.cursor/rules/javascript-insecure-design.mdc](.cursor/rules/javascript-insecure-design.mdc)

98−- [.cursor/rules/javascript-security-logging-monitoring-failures.mdc](.cursor/rules/javascript-security-logging-monitoring-failures.mdc)

99−- [.cursor/rules/javascript-security-misconfiguration.mdc](.cursor/rules/javascript-security-misconfiguration.mdc)

100−- [.cursor/rules/javascript-server-side-request-forgery.mdc](.cursor/rules/javascript-server-side-request-forgery.mdc)

101−- [.cursor/rules/javascript-software-data-integrity-failures.mdc](.cursor/rules/javascript-software-data-integrity-failures.mdc)

102−- [.cursor/rules/javascript-vulnerable-outdated-components.mdc](.cursor/rules/javascript-vulnerable-outdated-components.mdc)

39+# Test installation to custom directory

40+php install.php --all --destination=my/custom/path

10341

104−## Tag-Based Selection

105−The installer supports tag expressions and presets. Examples:

106−- `--tags "language:javascript category:security"`

107−- `--tags "framework:react"`

108−- `--tags "language:php standard:owasp-top10"`

109−- `--tag-preset js-owasp`

42+# Test installation via curl (non-interactive)

43+curl -s https://raw.githubusercontent.com/ivangrynenko/cursor-rules/main/install.php | php -- --ws

44+cat install.php | php -- --core # Test piped input locally

45+```

11046

111−See `TAG_STANDARDS.md` for the complete tag taxonomy and guidance.

47+### Linting and Code Quality

48+- PHP syntax validation: `php -l install.php`

49+- No specific linting commands configured - consider adding phpcs/phpmd

11250

113−## Maintainer Checklist

114−- Before opening a pull request, prepend a new entry to `CHANGELOG.md` describing your changes (latest release first) and never delete prior history.

115−- Ensure the summary in `CHANGELOG.md` matches the work being done and that `CURSOR_RULES_VERSION` reflects the next release number.

116−- Record key implementation notes in this `AGENTS.md` only when they affect installer behaviour or rule coverage so the instructions stay current.

117−- Regenerate project-local `AGENTS.md` files with `--yes` when you need to refresh them after significant rule or command updates.

51+## Architecture and Code Structure

11852

119−## Updating Or Removing

120−- To update, re-run the installer with your preferred options (it will copy over updated rules). See `README.md`.

121−- To remove rules, delete files from `.cursor/rules` and remove any generated `.cursorignore` files if not needed.

53+### Project Organization

54+- **install.php**: Main installer script (current version defined by CURSOR_RULES_VERSION constant)

55+- **.cursor/rules/**: Contains 56 MDC rule files organized by category

56+- **.cursor/UPDATE.md**: Installation receipt file tracking installed version and configuration (created by installer)

57+- **.tests/**: Bash test scripts for installer validation

58+- **.github/workflows/**: CI/CD pipeline using GitHub Actions for PHP 8.3

59+- **AGENTS.md**: Comprehensive guide for using Cursor Rules (created by installer)

12260

123−## References

124−- Project README: [README.md](README.md)

125−- Tag standards: [TAG_STANDARDS.md](TAG_STANDARDS.md)

126−- All rule sources: `.cursor/rules/*.mdc`

61+### Rule Categories

62+1. **Core Rules** (7 files): Git standards, testing guidelines, README maintenance

63+2. **Web Development Rules**:

64+ - Frontend: JavaScript, React, Vue, Tailwind, accessibility

65+ - Backend: PHP/Drupal standards, database

66+ - Security: OWASP Top 10 implementations for Drupal

67+ - DevOps: Docker, Lagoon, Vortex configurations

68+3. **Python Rules** (10 files): Security-focused rules following OWASP standards

12769

70+### Key Design Patterns

71+- **Installer Architecture**:

72+ - Stateless design - each execution is independent

73+ - Builder pattern for rule set construction

74+ - Strategy pattern for interactive vs non-interactive modes

75+ - Factory pattern for rule set management

76+

77+### Installation Flow

78+1. User executes install.php (directly or via curl)

79+2. Script detects if running interactively or with parameters

80+3. Creates .cursor/rules directory structure

81+4. Downloads and installs selected rule files from GitHub

82+5. Creates/overwrites .cursor/UPDATE.md file as an installation receipt

83+6. Creates/updates AGENTS.md documentation (unless --yes flag overwrites)

84+

85+## Versioning System

86+

87+### Version Management

88+- **Version Constant**: Defined in install.php as `CURSOR_RULES_VERSION`

89+- **Version History**: Tracked in GitHub releases and repository documentation

90+- **Release Process**:

91+ 1. Update CURSOR_RULES_VERSION constant in install.php

92+ 2. Update version history in repository documentation

93+ 3. Create GitHub release matching the version number

94+ 4. Tag the release in git

95+

96+### .cursor/UPDATE.md File Purpose

97+The UPDATE.md file serves as an installation receipt that:

98+- Records the version of cursor-rules that was installed

99+- Documents the installation date and time

100+- Lists the number of rule files installed

101+- Shows the installation type (core, web-stack, Python, etc.)

102+- Records any tag filters that were applied

103+- Gets created/overwritten by the installer on each run

104+- Helps users identify which version and configuration they have installed

105+

106+## Known Issues and Solutions

107+

108+### Curl Piping Issues (Fixed in v1.0.6)

109+When piping the installer through curl, several PHP-specific behaviors can cause problems:

110+

111+**Problem**: Script hangs when using `curl ... | php` commands

112+**Root Causes**:

113+1. `$_SERVER['PHP_SELF']` becomes "Standard input code" instead of script name when piped

114+2. PHP continues waiting for STDIN input even after script completion

115+3. Arguments may not parse correctly when using `--` separator with piped input

116+

117+**Solutions Implemented**:

118+1. **Entry Point Detection**: Check for both normal execution and "Standard input code"

119+ ```php

120+ if (basename(__FILE__) === basename($_SERVER['PHP_SELF'] ?? '') ||

121+ ($_SERVER['PHP_SELF'] ?? '') === 'Standard input code')

122+ ```

123+

124+2. **STDIN Cleanup**: Always close STDIN before exit to prevent hanging

125+ ```php

126+ if (defined('STDIN') && is_resource(STDIN)) {

127+ fclose(STDIN);

128+ }

129+ ```

130+

131+3. **Argument Parsing**: Handle both with and without `--` separator

132+ ```php

133+ if (!stream_isatty(STDIN) && $_SERVER['PHP_SELF'] === 'Standard input code') {

134+ // Parse arguments from argv when piped

135+ }

136+ ```

137+

138+### Testing Coverage Gaps

139+**Issue**: Test suite only covered direct PHP execution, not curl piping scenarios

140+**Recommendation**: Add tests for:

141+- `curl ... | php` execution paths

142+- `cat install.php | php` scenarios

143+- Argument parsing with and without `--` separator

144+- STDIN handling in different contexts

145+

146+## Important Considerations

147+

148+### When Adding New Rules

149+- Follow MDC format (Markdown with custom rule syntax)

150+- Place in appropriate category under .cursor/rules/

151+- Update the rule arrays in install.php (core_rules, web_stack_rules, python_rules)

152+- Add rule to README.md documentation table

153+- Consider rule dependencies (e.g., web stack includes core rules)

154+

155+### When Modifying the Installer

156+- Maintain PHP 8.3+ compatibility

157+- Preserve both interactive and non-interactive modes

158+- Update CURSOR_RULES_VERSION constant when making changes

159+- Ensure all tests pass before committing

160+- Test with both local files and GitHub downloads

161+

162+### Testing Guidelines

163+- All tests are bash scripts in .tests/ directory

164+- Tests use temporary directories to avoid affecting the actual installation

165+- Each test should output clear success/failure messages

166+- GitHub Actions runs all tests on push/PR to main branch

167+

168+## Security Considerations

169+- Never commit sensitive information or API keys

170+- Rule files should not contain hardcoded credentials

171+- Installer validates file permissions and directory creation

172+- Downloaded files are fetched over HTTPS from GitHub

173+

174+## Contributing

175+- Follow conventional commits format (fix:, feat:, docs:, etc.)

176+- Update relevant documentation when adding features

177+- Ensure all tests pass before submitting PR

178+- New rules should include clear descriptions and examples