Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/zhhjluka/hm-arch/codexgit clone --depth 1 https://github.com/zhhjluka/hm-archWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01070 |
| Opus 5 | $0.00000 | $0.00535 |
| Sonnet 5 | $0.00000 | $0.00214 |
| Haiku 4.5 | $0.00000 | $0.00107 |
Grade C, and why
codex scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf .codex How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex setup (HM-Arch)
Install HM-Arch, wire Codex lifecycle hooks, smoke-test, and uninstall. All steps are offline and do not require API keys.
Install HM-Arch
From a GitHub Release wheel (current v2.0.4):
python3.12 -m venv .venv && source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install /path/to/hm_arch-2.0.4-py3-none-any.whl
From PyPI:
pip install hm-arch
# or isolated CLI on PATH:
pipx install hm-arch
From npm:
npm install -g @hm-arch/installer
hm-arch-install install codex
Confirm the CLI:
hm-arch --help
# or, after npm install:
hm-arch-install --help
Connect Codex (project scope)
Run from your project root (where you want .codex/):
cd /path/to/your/project
hm-arch install codex
This creates or updates:
.codex/hooks.json— three HM-Arch hooks (recall,record,consolidate) invokinghm-arch codex recall|record|consolidate.codex/config.toml— enables[features] hooks = truewhen needed
Global installation
hm-arch install codex --global
hm-arch status codex --global
hm-arch uninstall codex --global
Smoke test
cd /path/to/your/project
hm-arch status codex
hm-arch doctor codex
Expected when installed:
statusreportsinstalledand lists rolesrecall,record,consolidatedoctorexits 0 when hooks and Codex hook feature flags are valid- Hooks use
hm-arch codex …whenhm-archis onPATH
Verify the HM-Arch bridge
Use the bridge commands first. They do not require a Codex model call and make it clear whether HM-Arch can record and recall memory:
cd /path/to/your/project
printf '%s' '{"prompt":"Codex-HM-Arch-local-check","last_assistant_message":"Stored through HM-Arch."}' \
| hm-arch codex record
printf '%s' '{"hook_event_name":"UserPromptSubmit","prompt":"Codex-HM-Arch-local-check"}' \
| hm-arch codex recall
The recall output should be JSON with:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 152 lines · 0 tokens per session scan C 2c37c2a15d88
codex is an agent published in the GitHub repository zhhjluka/hm-arch (18 stars, last pushed 2mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,070 tokens. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
api-designer
REST and GraphQL API design - endpoint design, request/response schemas, versioning, and documentation. Use for designing new APIs or evolving existing ones.
Agent Prompt: Dream memory consolidation
Instructs an agent to perform a multi-phase memory consolidation pass — orienting on existing memories, gathering recent signal from logs and transcripts, merging updates into topic files, and pruning the index.
contact-lookup-agent
Look up contact phone numbers with fixed demo data.
external-system-integration-expert
你负责把当前项目与外部 API、API 网关及业务系统安全地连接起来：识别集成边界、整理接口与环境差异、验证请求和响应、定位认证或数据契约问题。.
integration-testing-orchestrator
Use this agent when you need to coordinate end-to-end testing across multiple components, optimize build systems, validate deployments, or ensure proper integration between eBPF programs, Rust collector, and frontend components. Examples: Context: User has made changes to both eBPF programs and Rust collector and…
Audit
Deep security + performance audit of a specific diff. Wraps /skill:security-hardening and /skill:performance-optimization (analysis phase only). Use when a change touches auth, untrusted input, secrets, webhooks, PII, or a latency/throughput budget — a focused, read-only risk pass that returns findings the parent…