pi-web AGENTS.md

Development instructions for Pi Web, a web application in a specific code repository. They explain how to start, check, troubleshoot, and restart its development server.

In plain words
What is it for?
Use them when running the app locally, checking types or lint, investigating browser-only errors, or deciding whether a development server really needs restarting.
Why use it?
They prevent common development problems such as competing server processes, stale browser refresh data, and conflicts in Next.js temporary files.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/agegr/pi-web/agents-md
Clone the repo
git clone --depth 1 https://github.com/agegr/pi-web

Made for: Codex, OpenCode.

Per session 4,505 This file is loaded in full into every session.
When invoked 4,505 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.04505 $0.04505
Opus 5 $0.02253 $0.02253
Sonnet 5 $0.00901 $0.00901
Haiku 4.5 $0.00451 $0.00451

Measured yesterday against content hash e42631c2c2cb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

pi-web AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 235 lines

How it starts

The opening of the file, as written. The whole thing — 235 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Pi Web - Development Notes

Quick Start

npm run dev   # port 30141

Typecheck: node_modules/.bin/tsc --noEmit
Lint: npm run lint
Never run next build during dev — pollutes .next/ and breaks npm run dev.

Dev server troubleshooting

  • Before starting a server, run lsof -nP -iTCP:30141 -sTCP:LISTEN and reuse the existing Pi Web process when it is healthy. A second next dev for the same checkout cannot use a different port as a workaround because both processes contend for .next/dev/lock.
  • A browser-only Module ... factory is not available overlay usually means that tab has a stale Turbopack/HMR graph; it does not prove the server or source is broken. First call the browser's explicit reload action, then compare the current server log and a direct HTTP/API request.
  • Restart only after the failure reproduces from a fresh page and the server-side checks also fail. Stop the exact dev process gracefully, move .next into a mktemp -d backup, and restart with the standard npm run dev command.
  • Do not use next dev --webpack as a fallback. This repository's development graph can fail on undici imports such as node:console; development is expected to use Turbopack.
  • Next.js may append a generated BEGIN:nextjs-agent-rules block to AGENTS.md when next dev starts. Treat that as generated tooling output, verify it with git status, and do not include it in an unrelated feature commit.

Architecture

Browser                Next.js Server              AgentSession (in-process)
  │                        │                               │
  ├─ GET /api/sessions ────▶ reads ~/.pi/agent/sessions/   │
  ├─ GET /api/sessions/[id] reads .jsonl file directly     │
  ├─ GET /api/agent/running ───────▶ running id snapshot   │
  │                        │                               │
  ├─ send message ─────────▶ POST /api/agent/[id]          │
  │                        │   startRpcSession() ─────────▶│ createAgentSession()
  │                        │   session.send(cmd) ─────────▶│ session.prompt()
  │                        │                               │
  ├─ SSE connect ──────────▶ GET /api/agent/[id]/events    │
  │                        │   session.onEvent() ◀─────────│ session.subscribe()
  │◀── data: {...} ─────────│                               │

Read the full file on GitHub · 235 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 235 lines · 4,505 tokens per session scan A e42631c2c2cb

Subscribe to this mod's changes

pi-web AGENTS.md is an instructions file published in the GitHub repository agegr/pi-web (5,622 stars, last pushed 6d ago), licensed MIT. It adds 4,505 tokens to every session, about $0.0225 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.