zod AGENTS.md

zod AGENTS.md is an instructions file for Codex, OpenCode from colinhacks/zod. It costs 5,774 tokens per session, scanned A, original, MIT.

Project instructions for Zod, a TypeScript and JavaScript library for checking and describing data, including its workspace commands and development rules.

In plain words
What is it for?
Use them to build the project, run all or selected Vitest tests, update snapshots, check coverage, or work on compile-mode tests.
Why use it?
They help the coding agent follow the repository's build, test, coverage, compilation, and development conventions.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/colinhacks/zod/agents-md
Clone the repo
git clone --depth 1 https://github.com/colinhacks/zod

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for zod AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/colinhacks/zod/agents-md.svg)](https://agentmods.dev/instructions/colinhacks/zod/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/colinhacks/zod/agents-md"><img src="https://agentmods.dev/badge/instructions/colinhacks/zod/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 5,774 This file is loaded in full into every session.
When invoked 5,774 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.05774 $0.05774
Opus 5 $0.02887 $0.02887
Sonnet 5 $0.01155 $0.01155
Haiku 4.5 $0.00577 $0.00577

Measured 3d ago against content hash 2a47d6886e23, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

zod AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 216 lines

How it starts

The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Development Commands

The project uses pnpm workspaces. Key commands:

  • pnpm build - Build all packages (runs recursive build command)
  • pnpm vitest run - Run all tests with Vitest. Includes the compile-mode project, which re-runs the zod tests with global AOT compilation enabled (see wiki/compile.md).
  • pnpm vitest run <path> - Run specific test file (e.g., packages/zod/src/v4/classic/tests/string.test.ts)
  • pnpm vitest run <path> -t "<pattern>" - Run specific test(s) within a file (e.g., -t "MAC")
  • pnpm vitest run --update - Update all test snapshots
  • pnpm vitest run <path> --update - Update snapshots for specific test file
  • pnpm test:watch - Run tests in watch mode
  • pnpm vitest run --coverage - Run tests with coverage report
  • pnpm test:compile - Focused alias for just the compile-mode project. Already covered by pnpm test; use this when iterating on compile-related changes.
  • pnpm dev - Execute code with tsx under source conditions
  • pnpm dev <file> - Execute <file> with tsx & proper resolution conditions. Usually use for play.ts.
  • pnpm dev:play - Quick alias to run play.ts for experimentation
  • pnpm check:comments - Fail on stacked // comment lines (--fix joins them)
  • pnpm lint - Run biome linter with auto-fix
  • pnpm format - Format code with biome
  • pnpm fix - Run both format and lint

Rules

  • Node.js v24+ required (use nvm if needed); pnpm v10.12.1
  • ES modules are used throughout ("type": "module")
  • All tests must be written in TypeScript - never use JavaScript
  • Use play.ts for quick experimentation; use proper tests for all permanent test cases
  • Features without tests are incomplete - every new feature or bug fix needs test coverage
  • Don't skip tests due to type issues - fix the types instead
  • Test both success and failure cases with edge cases
  • Keep added tests as minimal and dense as possible without sacrificing comprehensiveness; avoid redundant assertions or broad fixtures when a focused case proves the behavior.
  • No log statements (console.log, debugger) in tests or production code
  • Never stack prose across consecutive // lines. Lines have no maximum width here — the editor wraps for display — so a paragraph split across several // lines is just a hard-wrapped line, and hard wrapping breaks search, diffs and editing. Write one long // instead. pnpm check:comments enforces this in pre-commit and CI; --fix joins the offenders. Commented-out code, @ts-/@__NO_SIDE_EFFECTS__-style pragmas, bullet lists, and blocks separated by a bare // are exempt. When two adjacent comments describe two different statements, separate them with a blank line rather than joining them.
  • Keep comments SHORT AND TIGHT — one lowercase sentence fragment, one clause, no trailing period. Never a capitalized full sentence, and never two of them. Extreme concision: say only what the code cannot say, and cut the setup sentence, the recap, and the same point restated in different words; a comment that needs three sentences usually means the code should be clearer. Identifiers keep their real casing (Error, parse()), only the prose is lowercase.
  • Ask before generating new files
  • Use util.defineLazy() for computed properties to avoid circular dependencies
  • Never branch on specific schema types in shared code. No def.type === "optional" conditionals, no hardcoded lists of wrapper type names, no walks up the wrapper chain hunting for a particular type. Every schema type added later silently falls through such a check, and the list is wrong the moment someone writes a new wrapper. When a shared path needs to know something about a schema, express it as a structural property on the internals — optin/optout, values, pattern, propValues — and let each type declare its own answer. This is not negotiable in the parse paths; a PR that adds edge-case conditional logic keyed on schema types will be rejected regardless of how well it is tested.
  • Performance is critical - parameter reassignment is allowed for optimization
  • Any change to packages/zod/src must be weighed on all three axes: runtime performance, memory consumption, and bundle size — see "The three axes" below. A change that improves one and is only checked on that one is not finished.
  • ALWAYS use the gh CLI to fetch GitHub information (issues, PRs, etc.) instead of relying on web search or assumptions
  • Keep JSDoc as minimal as possible. A self-explanatory type or symbol name needs no doc comment. When a comment is genuinely required, write one short sentence describing behavior — not history, rationale, or examples. Don't add interface-level JSDoc that just restates the interface name.
  • When you've modified a PR (or opened/closed/commented on one), include the PR URL liberally in summary messages — at minimum once at the end of any reply that touched it
  • When creating a PR, do not include a separate test plan section in the body. Link to any relevant issues under discussion, and use the same copywriting guidelines from "Commenting on issues and PRs": concise maintainer voice, prose over templates, and validation details only when they are material to the reader.
  • Format validators (z.iso.*, z.email(), z.url(), z.uuid(), …) are deliberately narrower than the specs they're named after. "The spec allows X" is not a reason to accept X — see "Format validators: spec compliance is not the bar" below.
  • NEVER bump the version in packages/zod/package.json (or any package's package.json). A version bump is the only thing that triggers a release; everything else (including direct pushes to main) is recoverable until that happens. If a version bump is genuinely needed, ask first.

Read the full file on GitHub · 216 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 216 lines · 5,774 tokens per session scan A 2a47d6886e23

Subscribe to this mod's changes

zod AGENTS.md is an instructions file published in the GitHub repository colinhacks/zod (43,628 stars, last pushed 4d ago), licensed MIT. It adds 5,774 tokens to every session, about $0.0289 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories

zod-skill AGENTS.md

Instructions for anivar/zod-skill, covering zod v4 — complete guide, abstract, 1. parsing & type safety, rule: use safeparse() for user input and rule: use parseasync for async refinements.

anivar/zod-skill · 4,602 tokens

react-seed AGENTS.md

Instructions for guokaigdg/react-seed, covering agents.md, 目录, 1. 项目概览, 2. 技术栈 and 3. 目录结构.

guokaigdg/react-seed · 5,007 tokens

persian-tools typescript.instructions.md

Instructions for persian-tools/persian-tools, covering typescript development instructions, typescript best practices for persian-tools, type safety, function signatures and type definitions.

persian-tools/persian-tools · 317 tokens

agentic-playwright enums.instructions.md

Instructions for idavidov13/agentic-playwright, covering enums, critical, file locations, instructions and phase 1: decide if the value belongs in an enum.

idavidov13/agentic-playwright · 2,598 tokens

ui-extensions-sdk CLAUDE.md

Instructions for contentful/ui-extensions-sdk, covering claude project instructions — ui-extensions-sdk, identity & scope, working style, sharp edges and verification before claiming done.

contentful/ui-extensions-sdk · 804 tokens

hana-developer-cli-tool-example mcp-server-development.instructions.md

Use when creating or updating MCP (Model Context Protocol) server components. Enforces TypeScript patterns, JSON-RPC communication rules, tool/resource/prompt registration, and integration with CLI command metadata. Ensures MCP server follows protocol requirements and maintains consistency with the CLI infrastructure.

SAP-samples/hana-developer-cli-tool-example · 4,811 tokens