Shifting Guardrails Left: Generating CLAUDE.md and .cursorrules from ESLint Rules

The standard software quality feedback loop looks like this: 1. Developer prompts AI assistant. 2. AI assistant generates code. 3. Developer runs linter or pushes to CI. 4. Linter fails with 4 errors. 5. Developer pastes errors back into AI assistant. 6. AI assistant fixes two errors and introduces another.

This "lint-fail-reprompt" ping-pong wastes tokens, increases context window fragmentation, and exhausts developer patience.

What if we could teach the AI assistant your project’s safety rules before it generates a single character of code?

This is the principle behind shifting guardrails left.

How AI Coding Assistants Read Project Context

Modern AI coding environments support repository-level context files: - Claude Code: Reads CLAUDE.md at the workspace root before processing user commands. - Cursor IDE: Reads .cursorrules to guide its Composer model and Copilot completions. - GitHub Copilot: Reads .github/copilot-instructions.md during chat and code generation.

If these files are empty or contain generic instructions ("write clean TypeScript"), the model defaults to standard training distributions—which include all the anti-patterns we see in production.

Enter `ai-guard init-context`

AI Guard includes a dedicated command that compiles your configured ESLint rules into high-leverage prompt directives:

npx ai-guard init-context

When executed, AI Guard inspects your active ruleset and generates or updates the context files automatically:

# AI Guard Context Guardrails (Auto-generated)

## Asynchronous Invariants
- Every Promise-returning invocation MUST be explicitly awaited or handled with .catch(). Never leave floating promises.
- In Array iteration (.map, .filter, .forEach), DO NOT pass async callbacks unless wrapped with Promise.all().
- Do not use redundant 'return await' outside try/catch blocks.

## Error Handling Invariants
- Catch blocks must NEVER be empty. If ignoring an error, write an explicit comment explaining why.
- Do not catch generic 'any' without proper narrowing.

## Security Invariants
- NEVER embed hardcoded API keys, JWT secrets, or tokens. Use process.env variables.
- NEVER concatenate raw strings into database query functions. Use parameterized queries.
- Protected API routes MUST apply authentication middleware before handler execution.

Real-World Impact on Generation Quality

We tested model output across 100 sample prompts (asking for Express route handlers, async queues, and webhook processors) with and without init-context files:

By providing concrete, rule-backed constraints directly in the AI's native context window, models avoid anti-patterns at generation time.

The Two-Tiered Defense

Shifting left does not mean eliminating linters: - Tier 1 (Context Files): Prevents 90%+ of mistakes at the prompt level. - Tier 2 (ESLint & CLI): Deterministically verifies the remaining 10% in CI.

Try it in your project today:

npx ai-guard init-context