upilot AGENTS.md

Repository instructions for UPilot, including its release process, testing checks, and planned improvements.

In plain words
What is it for?
Preparing UPilot releases, checking that changes are committed and pushed, starting the release workflow, and monitoring its build jobs.
Why use it?
They define how releases are authorized, versioned, triggered, and verified so repository changes follow the project’s rules.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/codingriver/upilot/agents-md
Clone the repo
git clone --depth 1 https://github.com/codingriver/upilot

Made for: Codex, OpenCode.

Per session 729 This file is loaded in full into every session.
When invoked 729 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00729 $0.00729
Opus 5 $0.00365 $0.00365
Sonnet 5 $0.00146 $0.00146
Haiku 4.5 $0.00073 $0.00073

Measured yesterday against content hash 332cfd128f30, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

upilot AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 28 lines

How it starts

The opening of the file, as written. The whole thing — 28 lines — stays where its author put it; the contents beside it link to each section on GitHub.

UPilot Repository Instructions

Release Workflow

  • Treat commands such as 发布版本 v0.3.22,并检查打包结果和版本号是否正确, 发布 v0.3.22, 触发发布版本 0.3.22, and semantically equivalent requests as explicit authorization to run the GitHub Actions workflow named 发布版本 from .github/workflows/prepare-release.yml.
  • Use the requested semantic version after normalizing it to vMAJOR.MINOR.PATCH. If the user requests the next version without specifying a number, inspect existing tags and use the next patch version unless the user states otherwise.
  • Trigger the workflow from main with gh workflow run prepare-release.yml --ref main -f version=<version>. Do not manually create or push the release tag, and do not manually maintain release versions in package.json or upilotserver~/pyproject.toml; the workflow owns those operations.
  • Before triggering a release, verify that the intended release changes are committed and pushed to main. Do not include unrelated local changes without explicit authorization.
  • After triggering, monitor both the 发布版本 run and its downstream Build UPilot MCP Server EXE run until completion. A successful dispatch alone is not a successful release.
  • Verify that the release tag exists, the GitHub release and expected assets were published, and the version in the tag's package.json and upilotserver~/pyproject.toml exactly matches the requested version. Report run URLs, commit/tag information, asset results, and any version mismatch or failed job clearly.
  • If either workflow fails or any version is inconsistent, do not report release success. Preserve the failure logs and identify the failed step and corrective action.

Testing And Validation

  • Use ./Tests~/UPilotTest as the default and canonical Unity project for UPilot package compile and EditMode acceptance.
  • After UPilot C# or assembly-related changes, validate against ./Tests~/UPilotTest before claiming Unity compile/EditMode acceptance, unless the user explicitly says not to run tests.
  • Do not attempt a full EditMode suite by default. Unless the user explicitly requests a full/complete EditMode regression, run only the narrowest targeted tests that cover the changed code and its direct regressions.
  • A full EditMode run is authorized only when the user explicitly asks for full, complete, regression, acceptance, or equivalent whole-suite validation; otherwise report targeted results and any unrun coverage.
  • If a full-suite run is not explicitly authorized, do not start it speculatively after targeted tests pass, even when preparing a final handoff.
  • Do not use external client projects such as D:\MA\xclient or F:\xclient2 as default UPilot validation projects.
  • Use external client projects only when the user explicitly requests project-side/business smoke validation or investigation.

Read the full file on GitHub · 28 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 28 lines · 729 tokens per session scan A 332cfd128f30

Subscribe to this mod's changes

upilot AGENTS.md is an instructions file published in the GitHub repository codingriver/upilot (0 stars, last pushed 4d ago), licensed MIT. It adds 729 tokens to every session, about $0.0036 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.