agent-device AGENTS.md

A guide to the AGENTS.md instructions for the agent-device repository, including its architecture, rules, tests, and task-specific procedures.

In plain words
What is it for?
Use it when working on architecture, tests, command-line flags, pull requests, real-device verification, issue tracking, selectors, or the web backend.
Why use it?
It points developers to the repository guidance that prevents rediscovering important constraints and choosing the wrong workflow.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/callstack/agent-device/agents-md
Clone the repo
git clone --depth 1 https://github.com/callstack/agent-device

Made for: Codex, OpenCode.

Per session 2,120 This file is loaded in full into every session.
When invoked 2,120 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02120 $0.02120
Opus 5 $0.01060 $0.01060
Sonnet 5 $0.00424 $0.00424
Haiku 4.5 $0.00212 $0.00212

Measured today against content hash fa7228f184b6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

agent-device AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 160 lines

How it starts

The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

agent-device is a CLI and daemon for automating Apple, Android, HarmonyOS, Vega, Linux, and web targets. A long-lived daemon owns sessions; registry-derived commands route to platform runtimes.

This file contains repository-specific traps and invariants that are expensive to rediscover. Load task procedures only when needed:

When the task involves Read
Domain vocabulary CONTEXT.md, docs/agents/domain.md
Architecture decisions docs/adr/README.md
Tests or gate selection docs/agents/testing.md
Selector capture, polling, or interaction fast paths docs/agents/selector-capture.md
Adding or changing a CLI flag docs/agents/cli-flags.md
Opening or reviewing a PR docs/agents/pull-requests.md
Running against a real device docs/agents/device-verification.md
Issues, PRDs, and triage labels docs/agents/issue-tracker.md, docs/agents/triage-labels.md
Web backend setup or diagnostics docs/agents/web-backend.md

Versioned CLI help is the source of truth for command behavior. Start workflow planning with agent-device help workflow, then use the relevant topic help.

Incident-derived principles

  • Guarantees erode at path boundaries. Classify every interaction dispatch path in packages/contracts/src/interaction-guarantees.ts; a registry claim is not proof that the native implementation satisfies the guarantee's definition.
  • Delegation on error proves no success-path parity. A fast path may succeed on a candidate the shared rules would refuse.
  • Prove that a code path can fire before measuring it. An A/B test with an unreachable arm is two green runs without evidence.
  • A green regression test counts only after it has been observed red against the pre-fix code. Plant a violation for new structural gates and verify the gate names the invariant.
  • Repair recurring failures at their owning interface with types, a registry, or one construction path. A custom guard that reconstructs another source of truth needs redesign, not another exception.
  • Treat explanatory implementation comments as a failed design review. Do not narrate control flow, preserve review history, or justify a workaround in code. Express the invariant through names, types, module boundaries, and tests; put history in the PR or an ADR. Allow only public API docs, tool directives, and a brief citation to an external constraint that cannot be encoded.
  • Key behavior on typed reasons and details, never error text. Existing message sniffs are owned debt and must not be copied.
  • Snapshot output is the token budget: do not add per-node metadata when response-level metadata can be emitted once. Append warnings through the shared response builder; never replace prior warnings.
  • Before preserving a compatibility shape, run git tag --contains <commit>. Unreleased API has no external compatibility obligation.

Read the full file on GitHub · 160 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +2 lines · +46 tokens per session fa7228f184b6
  2. 2d ago First seen · 158 lines · 2,074 tokens per session scan A 39d28ec04ee9

Subscribe to this mod's changes

agent-device AGENTS.md is an instructions file published in the GitHub repository callstack/agent-device (4,300 stars, last pushed today), licensed MIT. It adds 2,120 tokens to every session, about $0.0106 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.