adminforth AGENTS.md

A set of project instructions for devforth and adminforth repositories, covering package management, naming, documentation paths, and engineering rules.

In plain words
What is it for?
Use it when adding packages, plugins, adapters, Docusaurus pages, demos, documentation, or code to these projects.
Why use it?
It helps coding agents follow the repository’s existing conventions instead of making inconsistent package, documentation, or code decisions.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/devforth/adminforth/agents-md
Clone the repo
git clone --depth 1 https://github.com/devforth/adminforth

Made for: Codex, OpenCode.

Per session 1,395 This file is loaded in full into every session.
When invoked 1,395 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01395 $0.01395
Opus 5 $0.00698 $0.00698
Sonnet 5 $0.00279 $0.00279
Haiku 4.5 $0.00139 $0.00139

Measured yesterday against content hash 6bfb3b96d744, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

adminforth AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 230 lines

How it starts

The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Package manager

All packages and projects in this repo use pnpm and not npm. Howeverer internally (e.g. in codeInjector) adminforth still supports both npm and pnpm style install commands, so users of framework itself can use it with either package manager. But in all dev demo/live demo, plugins, adapters, and documentation, we use pnpm as the standard.

Package names rules

All adapters and plugins always have @adminforth/ prefix in their package name, followed by short lowercase kebab-case plugin/adpater slug.

Every plugin has at least one Docusaurus docs page, which should use the path /docs/tutorial/Plugins/<plugin-slug>/.

Same for adapters, but with /docs/tutorial/Adapters/<adapter-slug>/ path.

Page names in docusarus should be human readabale. We should not use AuditLog but instead we should have Audit Log via whitespace.

General engineering rules

Write code as if the system contracts are already defined and trusted.

Do not add defensive checks “just in case” when the contract, type, schema, backend response, or controlled internal API already guarantees the shape of the data.

Prefer simplicity, clarity, and consistency over paranoia.

Follow these principles strictly:

  • DRY
  • SOLID
  • YAGNI
  • Keep code minimal
  • Trust typed contracts
  • Avoid duplicate validation
  • Avoid speculative fallback logic
  • Avoid inline regex literals when reused or non-trivial

Trust the contract

If backend and frontend are part of the same system, and the backend explicitly guarantees a response shape, do not re-validate every field on the frontend.

Bad:

  • backend returns a strict object
  • frontend then checks every field for undefined, wrong type, empty string, wrong enum, etc.
  • frontend adds fallback branches for impossible states

Good:

  • backend owns validation
  • shared types or schemas define the contract
  • frontend consumes the contract directly
  • frontend only handles real UI states, not imaginary protocol corruption

Read the full file on GitHub · 230 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 230 lines · 1,395 tokens per session scan A 6bfb3b96d744

Subscribe to this mod's changes

adminforth AGENTS.md is an instructions file published in the GitHub repository devforth/adminforth (390 stars, last pushed 4d ago), licensed MIT. It adds 1,395 tokens to every session, about $0.0070 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories