NEW: Claude Code Security — research preview

Core Workflows

TDD with YOLO+hooks, incremental refactoring, Debug Mode, Parallel Agents, and progressive enhancement.

Read time: 15 min

title: "Core Workflows" description: "TDD with YOLO+hooks, incremental refactoring, Debug Mode, Parallel Agents, and progressive enhancement." section: "Full Guide" readTime: "15 min"

Core Workflows

These workflows leverage skills and hooks for autonomous iteration — maximizing productivity while maintaining code quality.

TDD with YOLO Mode + Hooks

The most powerful Cursor workflow: write tests, implement, auto-iterate until all tests pass.

Setup YOLO Mode (Settings > Agent > YOLO Mode):

Allow: test, build, tsc, mkdir, touch, npm test, npm run
Deny: rm -rf, drop database (destructive ops)

Configure stop hook (.cursor/hooks.json):

{
  "hooks": {
    "stop": {
      "script": "./scripts/stop-when-tests-pass.sh",
      "description": "Continue until all tests pass"
    }
  }
}
#!/bin/bash
npm test --silent
[ $? -eq 0 ] && exit 1 || exit 0

TDD prompt template:

Write tests first, then implementation, then run tests and fix until passing.

Context:
- Test framework: Vitest
- Coverage target: >80%
- Edge cases: null, undefined, empty array, large inputs

Task: Implement markdown-to-HTML converter

Requirements:
1. Tests: basic markdown, edge cases, XSS attempts, performance (10MB input)
2. Implementation: use marked library, sanitize with DOMPurify
3. Agent workflow:
   - Generate test suite
   - Wait for test approval
   - Implement
   - Run tests automatically
   - Fix failures iteratively
   - Report when all pass

DO NOT PROCEED to implementation until tests are reviewed.

Flow with YOLO + Hooks:

  1. Agent creates test file with N test cases
  2. You review → approve
  3. Agent implements
  4. Runs npm test → fail → hook says "continue" → agent fixes
  5. Repeats until all pass → hook detects success → stops
  6. Reports completion — no manual intervention needed

Using the Test-Loop Skill

Instead of describing the TDD workflow every time, use the skill:

/test-loop

@instructions.md Implement password reset feature with comprehensive tests.

Or activate automatically by mentioning "TDD approach" — the agent recognizes it and activates the skill.

Incremental Refactoring Pattern

Never do this:

Refactor this 500-line file to use modern patterns.

Result: massive diff, unverifiable, likely breaks edge cases.

Always do this (incremental):

Step 1: Analyze @src/routes/users.ts
Identify: code smells, tech debt, performance issues, test coverage gaps.
Wait for review before proceeding.

Step 2: Plan refactoring into 3-5 atomic steps.
Show effort estimate, risks, rollback plan per step.
Wait for approval.

Step 3: Execute step 1 only. Show diff. Run tests. Wait for approval.

Step 4: Repeat for remaining steps.

Express → Fastify migration example:

@instructions.md @src/routes/

Phase 1: Analysis — list all routes, middleware, Express-specific features.
Phase 2: Plan 5-step migration with rollback plan per step.
Phase 3: Create src/fastify-server.ts on port 3001 (Express stays on 3000).
         Test: curl localhost:3001/health. Wait for approval.
[Continue one route group at a time...]

Constraints:
- No breaking changes to API contract
- Backward compatibility for 2 weeks (both servers running)

Debug Mode Workflow

Use when a bug is elusive, intermittent, or in async code.

How it works:

  1. Describe the bug with exact error, environment, reproduction steps
  2. Agent generates hypotheses
  3. Agent instruments code with debug logs
  4. You reproduce the bug
  5. Agent analyzes logs → identifies root cause → proposes fix → applies + verifies

Example prompt:

Bug: User sessions randomly expire after ~5 minutes (expected: 24 hours)

Framework: Express + express-session
Session store: Redis
Auth: JWT + refresh tokens
Environment: Production only (dev works fine)

Hypotheses to investigate:
- Redis connection issues (pool exhaustion?)
- Session cookie config (SameSite, Secure flags)
- Clock drift between servers
- Race condition in token refresh

Instrument code and analyze.

After you reproduce: paste logs → agent identifies root cause (e.g., missing secure: true) → fixes.

Parallel Agents

Run multiple agents simultaneously to explore different approaches. Best for architecture decisions or complex refactors.

Setup git worktrees:

git worktree add ../cursor-agent-1 HEAD
git worktree add ../cursor-agent-2 HEAD
git worktree add ../cursor-agent-3 HEAD

Prompt (open 3 parallel agents):

Run 3 parallel agents to implement user authentication:

Agent 1: JWT with refresh tokens
Agent 2: Session-based with Redis
Agent 3: Passkey (WebAuthn)

For each approach:
- Implement auth flow
- Write tests
- Document pros/cons
- Estimate implementation time

Evaluate and recommend best approach.

Cursor runs them simultaneously, evaluates results, presents best option.

Progressive Enhancement Pattern

Build features in phases — ship Phase 1 while building Phase 2.

@instructions.md

Implement search feature in 4 phases:

Phase 1: MVP
- Input field + search button + results list
- No filters, sorting, pagination
Generate code + tests. Run tests. Wait for approval.

Phase 2: Add features
- Filters (category, price range)
- Sorting (relevance, date, price)
Generate code + tests. Run tests. Wait for approval.

Phase 3: Optimize
- Debounced input (300ms)
- Loading/empty/error states
- Keyboard shortcuts (Cmd+K to focus)
Generate code + tests. Run tests. Wait for approval.

Phase 4: Polish
- Infinite scroll, highlight terms, recent searches (localStorage)
Generate final version + tests.

Essential Keyboard Shortcuts

ActionWindows/LinuxmacOS
Tab autocompleteTabTab
Inline EditCtrl+KCmd+K
Composer / AgentCtrl+ICmd+I
ChatCtrl+LCmd+L
New chatCtrl+Shift+LCmd+Shift+L
Submit promptCtrl+EnterCmd+Enter
Cancel agentEscEsc
Command paletteCtrl+Shift+PCmd+Shift+P
Slash commands//
Mention context@@
Quick file openCtrl+PCmd+P
Find in projectCtrl+Shift+FCmd+Shift+F