alpaca-trade-api-js: Instructions file for Codex

AGENTS.md

alpaca-trade-api-js AGENTS.md is an instructions file for Codex, OpenCode from alpacahq/alpaca-trade-api-js. It costs 2,837 tokens per session, scanned A, original, Apache-2.0.

Contributor rules for a TypeScript software library that connects applications to Alpaca’s trading and market-data services. The library includes generated API code plus hand-written helpers for requests, retries, timeouts, errors, pagination, and tests.

In plain words
What is it for?
Use them when modifying the SDK, its code-generation templates, request helpers, error handling, retries, timeouts, pagination, tests, or release process.
Why use it?
They prevent manual edits to generated code from being lost and document behaviors that must remain intact when the API client is regenerated or changed.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md.

This is alpacahq/alpaca-trade-api-js's own configuration. It tells Codex and OpenCode how to work on alpaca-trade-api-js itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything alpaca-trade-api-js configures →

Reuse

Borrowing it

Nothing to install: this file belongs to alpacahq/alpaca-trade-api-js. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/alpacahq/alpaca-trade-api-js/master/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/alpacahq/alpaca-trade-api-js

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for alpaca-trade-api-js AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/alpacahq/alpaca-trade-api-js/agents-md.svg)](https://agentmods.dev/instructions/alpacahq/alpaca-trade-api-js/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/alpacahq/alpaca-trade-api-js/agents-md"><img src="https://agentmods.dev/badge/instructions/alpacahq/alpaca-trade-api-js/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 2,837 This file is loaded in full into every session.
When invoked 2,837 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.02837 $0.02837
Opus 5 $0.01418 $0.01418
Sonnet 5 $0.00567 $0.00567
Haiku 4.5 $0.00284 $0.00284

Measured 4d ago against content hash ebc35f1c371b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

alpaca-trade-api-js AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 201 lines

How it starts

The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Instructions for AI agents and contributors working in the @alpacahq/alpaca-trade-api package.

Overview

@alpacahq/alpaca-trade-api is a TypeScript SDK for the Alpaca Trading API and Market Data API. The REST clients/models are generated with OpenAPI Generator via the reproducible pipeline in tooling/ (npm run generate); they stay a faithful snapshot of Alpaca's OpenAPI spec, and every convenience is hand-written in separate modules (see the first convention below). Crucially, the generated trees are never hand-edited — every required deviation from stock generator output is encoded declaratively in forked Mustache templates or JSON Patch overlays, so regeneration reproduces the committed trees byte-for-byte. See tooling/GENERATION.md for the full design. Notable behaviors to preserve when editing:

  • null-safe array deserialization (no NPE on null array fields),
  • opt-in retry/backoff (retry), request timeouts (timeoutMs), default User-Agent,
  • typed ApiError parsing the { code, message } envelope,
  • undocumented-field passthrough on key trading models,
  • a pagination helper, and a vitest test suite.

Conventions

  • Generated vs hand-written — never hand-edit the generated trees. The src/trading/{apis,models,index.ts} and src/market-data/{apis,models,index.ts} trees are generator output, reproduced by npm run generate (see tooling/). Treat them as derived artifacts: never hand-edit them. If you need to change generated output, change the spec/overlay/template in tooling/ and regenerate — npm run generate:offline must reproduce the trees byte-for-byte. All behavior, ergonomics, and fixes live in hand-written modules outside those trees (src/client.ts, src/orders.ts, src/marketDataShapes.ts, src/core/runtime.ts, src/streaming/, ...).
  • Regeneration-safe customizations live in tooling/. Three deviations from stock typescript-fetch are encoded declaratively so they survive every regeneration: (1) null-safe required-array deserialization — forked templates/typescript-fetch/modelGeneric.mustache; (2) undocumented-field passthrough on 6 trading models — x-ts-passthrough vendor extension (trading overlay) + forked templates; (3) market-data feed enum tightening — market-data overlay. Add new fixes the same way (template or overlay), never as a hand-edit.
  • The transport is shared. The HTTP transport (retry/backoff, timeouts, rate limiting, typed errors, middleware, querystring, response wrappers) lives once in src/core/runtime.ts. src/trading/runtime.ts and src/market-data/runtime.ts are thin shims that export * from it and only add their host constants plus a Configuration subclass overriding defaultBasePath(). Make transport changes in src/core/runtime.ts; touch the shims only for host/base-path concerns. These shims sit inside the generated trees but are hand-maintained transport code, protected from regeneration by .openapi-generator-ignore; treat them as the hand-written exceptions inside those otherwise generator-owned trees.
  • Edit src/ directly for behavior changes.
  • Keep the capability maps in sync. When you add an ergonomic helper to TradingClient / MarketDataClient / OrdersApi (src/client.ts), add it to ergonomicCapabilities in src/capabilities.ts — a test in test/client.test.ts asserts every listed helper exists on the facade.
  • Linting is scoped to hand-written code. Biome (linter only; formatter and assist are off) lints the hand-maintained TypeScript. The OpenAPI-generated src/trading/{apis,models,index.ts} and src/market-data/{apis,models,index.ts} are excluded in biome.json — they're generator output, so don't lint or hand-edit them.
  • Keep the test suite green and add coverage for new behavior.

Read the full file on GitHub · 201 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago Changed · +4 lines · +45 tokens per session ebc35f1c371b
  2. 8d ago First seen · 197 lines · 2,792 tokens per session scan A 676f94cf8890

Subscribe to this mod's changes

alpaca-trade-api-js AGENTS.md is an instructions file published in the GitHub repository alpacahq/alpaca-trade-api-js (601 stars, last pushed 4d ago), licensed Apache-2.0. It adds 2,837 tokens to every session, about $0.0142 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).

microsoft/vscode · 5,001 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,469 tokens

spec-kit AGENTS.md

AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.

github/spec-kit · 7,104 tokens