minshop AGENTS.md

Project instructions for working on minshop, a small online shop built with Astro and Cloudflare services. They describe the project’s development loop, checks, local data tools, and common commands.

In plain words
What is it for?
Use them when developing, testing, inspecting local shop data, or validating changes in the minshop codebase.
Why use it?
They give an agent the project-specific rules it needs before changing code. This reduces mistakes caused by using the wrong runtime, command, data-inspection method, or verification step.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/ddyy/minshop/agents-md
Clone the repo
git clone --depth 1 https://github.com/ddyy/minshop

Made for: Codex, OpenCode.

Per session 3,889 This file is loaded in full into every session.
When invoked 3,889 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03889 $0.03889
Opus 5 $0.01945 $0.01945
Sonnet 5 $0.00778 $0.00778
Haiku 4.5 $0.00389 $0.00389

Measured 2d ago against content hash 91207e421ddb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

minshop AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s localhost:4321/cdn-cgi/explorer/api/d1/database/DB/raw \
AGENTS.md · 260 lines

How it starts

The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md — working on minshop

A guide for contributors and automated tooling making changes to minshop: a small, full-Cloudflare ecommerce store (Astro 7 SSR on Workers + D1 + R2 + Stripe / Lightning). Read this before editing. It's the map, the rules, the recipes, and the traps.

The loop (run this constantly)

nvm use 22         # REQUIRED — the supported toolchain runs on Node 22
npm run verify     # complete storefront + D1 + MCP green/red gate

npm run verify is the single signal that a change is sound: it runs unit tests, full Astro diagnostics, the production build, the clean-room D1 integration, and the MCP typecheck/deployment dry run. If it's green, the change holds together. Run it after every meaningful edit, not just at the end.

Other commands: npm run dev (astro dev), npm run preview (wrangler dev = production mode, for testing middleware/auth), npm run db:migrate (local D1), npm test.

Inspecting local data: use Local Explorer, not the CLI

Any local dev server (npm run dev, npm run preview) serves Cloudflare's Local Explorer — a UI at /cdn-cgi/explorer and a self-describing REST API at /cdn-cgi/explorer/api covering D1, KV, R2, Durable Objects and Workflows. It reads the same local state the app does, with no setup.

Prefer it over npx wrangler d1 execute --local for reads and fixture setup: that spawns a process each time (~1.2s) where this is an HTTP call (~0.02s) — roughly 70x, which is the difference between checking state freely and avoiding it. GET /cdn-cgi/explorer/api returns the OpenAPI spec, so the endpoints are discoverable rather than memorized. The D1 database id is the binding name:

curl -s localhost:4321/cdn-cgi/explorer/api/d1/database/DB/raw \
  -H 'content-type: application/json' \
  -d '{"sql":"SELECT status, COUNT(*) FROM orders GROUP BY status"}'

Local only, and unauthenticated on the dev origin — it is never exposed on a deployed Worker, but do not bind a dev server to a public interface. Anything touching --remote still goes through wrangler. The API reports itself as version 0.0.1, so use it for working loops, not as the basis of a test gate.

Read the full file on GitHub · 260 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 260 lines · 3,889 tokens per session scan A 91207e421ddb

Subscribe to this mod's changes

minshop AGENTS.md is an instructions file published in the GitHub repository ddyy/minshop (120 stars, last pushed 7d ago), licensed MIT. It adds 3,889 tokens to every session, about $0.0194 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.