duet-agent AGENTS.md

duet-agent AGENTS.md is an instructions file for Codex, OpenCode from dzhng/duet-agent. It costs 1,591 tokens per session, scanned A, original, Apache-2.0.

Project instructions for duet-agent, covering code documentation, naming, comments, and local safeguards. They guide how types and source code should explain behaviour and remain current after refactoring.

In plain words
What is it for?
Use them when editing duet-agent types, configuration fields, detection or guard logic, comments, and refactored code.
Why use it?
They reduce confusion caused by stale names, misleading comments, and documentation that merely repeats code. They encourage checks close to the behaviour they protect.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/dzhng/duet-agent/agents-md
Clone the repo
git clone --depth 1 https://github.com/dzhng/duet-agent

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for duet-agent AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/dzhng/duet-agent/agents-md.svg)](https://agentmods.dev/instructions/dzhng/duet-agent/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/dzhng/duet-agent/agents-md"><img src="https://agentmods.dev/badge/instructions/dzhng/duet-agent/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 1,591 This file is loaded in full into every session.
When invoked 1,591 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01591 $0.01591
Opus 5 $0.00796 $0.00796
Sonnet 5 $0.00318 $0.00318
Haiku 4.5 $0.00159 $0.00159

Measured 4d ago against content hash 84b51169900f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

duet-agent AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agent Guidelines

Treat Types As Documentation

  • Type files and exported type declarations are part of the public documentation surface.
  • Add comments where a field is declared, especially for config options and callback contracts.
  • Explain how the field is used, what values mean operationally, and what changes when it is set.
  • Prefer comments that document why a field exists or how downstream code interprets it.
  • Avoid comments that only restate the type, such as "string value" or "array of items".

Keep Names Current

  • Names should describe what code does now, not what it used to do.
  • After refactors, search for old names, stale comments, abandoned feature flags, and dead detection logic.
  • Do not preserve compatibility shims for unshipped scaffold code. Replace the scaffold outright.

Keep Comments Useful

  • Keep comments for non-obvious behavior, platform quirks, invariants, and downstream consequences.
  • Remove narrative comments about previous attempts, renamed code, or abandoned approaches.
  • Remove comments that simply repeat the implementation.

Prefer Direct, Local Guarantees

  • Detection and guard logic should check the one condition that actually matters.
  • When a value becomes guaranteed, remove redundant fallback code and stale null checks downstream.
  • Prefer const over let when reassignment is not needed.
  • Do not suppress signals with _ parameters, as any, @ts-ignore, or lint disables. Fix the source issue.

Avoid Thin Wrappers

  • Do not create modules that only re-export another package.
  • Import upstream APIs directly unless this project adds real semantics at the boundary.
  • A local helper should earn its place by centralizing project-specific behavior.

Keep Runtime And Persistence Separate

  • The turn runner runtime should not own persistence policy.
  • Persistence should hydrate the concrete runtime store before use, then subscribe to store events for future writes.
  • Install scripts set up prerequisites; runtime commands handle runtime work.

Read the full file on GitHub · 83 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 83 lines · 1,591 tokens per session scan A 84b51169900f

Subscribe to this mod's changes

duet-agent AGENTS.md is an instructions file published in the GitHub repository dzhng/duet-agent (42 stars, last pushed yesterday), licensed Apache-2.0. It adds 1,591 tokens to every session, about $0.0080 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.