hermes-desktop AGENTS.md

A project-specific instruction guide for working with AGENTS.md and lat.md, a linked set of Markdown files that explains a project's architecture, decisions, business rules, and tests.

In plain words
What is it for?
Use it to search and expand lat.md references, update documentation after changes, and run the project's lat check command.
Why use it?
It tells an agent how to find the relevant project context before changing code and what checks and documentation updates are required afterward.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/fathah/hermes-desktop/agents-md
Clone the repo
git clone --depth 1 https://github.com/fathah/hermes-desktop

Made for: Codex, OpenCode.

Per session 1,250 This file is loaded in full into every session.
When invoked 1,250 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01250 $0.01250
Opus 5 $0.00625 $0.00625
Sonnet 5 $0.00250 $0.00250
Haiku 4.5 $0.00125 $0.00125

Measured yesterday against content hash 5fd49383be7f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

hermes-desktop AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

3 near-identical copies found in the catalogue:

AGENTS.md · 106 lines

How it starts

The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Before starting work

  • Run lat search to find sections relevant to your task. Read them to understand the design intent before writing code.
  • Run lat expand on user prompts to expand any [[refs]] — this resolves section names to file locations and provides context.

Post-task checklist (REQUIRED — do not skip)

After EVERY task, before responding to the user:

  • Update lat.md/ if you added or changed any functionality, architecture, tests, or behavior
  • Run lat check — all wiki links and code refs must pass
  • Do not skip these steps. Do not consider your task done until both are complete.

What is lat.md?

This project uses lat.md to maintain a structured knowledge graph of its architecture, design decisions, and test specs in the lat.md/ directory. It is a set of cross-linked markdown files that describe what this project does and why — the domain concepts, key design decisions, business logic, and test specifications. Use it to ground your work in the actual architecture rather than guessing.

Commands

lat locate "Section Name"      # find a section by name (exact, fuzzy)
lat refs "file#Section"        # find what references a section
lat search "natural language"  # semantic search across all sections
lat expand "user prompt text"  # expand [[refs]] to resolved locations
lat check                      # validate all links and code refs

Run lat --help when in doubt about available commands or options.

If lat search fails because no API key is configured, explain to the user that semantic search requires a key provided via LAT_LLM_KEY (direct value), LAT_LLM_KEY_FILE (path to key file), or LAT_LLM_KEY_HELPER (command that prints the key). Supported key prefixes: sk-... (OpenAI) or vck_... (Vercel). If the user doesn't want to set it up, use lat locate for direct lookups instead.

Syntax primer

  • Section ids: lat.md/path/to/file#Heading#SubHeading — full form uses project-root-relative path (e.g. lat.md/tests/search#RAG Replay Tests). Short form uses bare file name when unique (e.g. search#RAG Replay Tests, cli#search#Indexing).
  • Wiki links: [[target]] or [[target|alias]] — cross-references between sections. Can also reference source code: [[src/foo.ts#myFunction]].
  • Source code links: Wiki links in lat.md/ files can reference functions, classes, constants, and methods in TypeScript/JavaScript/Python/Rust/Go/C files. Use the full path: [[src/config.ts#getConfigDir]], [[src/server.ts#App#listen]] (class method), [[lib/utils.py#parse_args]], [[src/lib.rs#Greeter#greet]] (Rust impl method), [[src/app.go#Greeter#Greet]] (Go method), [[src/app.h#Greeter]] (C struct). lat check validates these exist.
  • Code refs: // @lat: [[section-id]] (JS/TS/Rust/Go/C) or # @lat: [[section-id]] (Python) — ties source code to concepts

Read the full file on GitHub · 106 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 106 lines · 1,250 tokens per session scan A 5fd49383be7f

Subscribe to this mod's changes

hermes-desktop AGENTS.md is an instructions file published in the GitHub repository fathah/hermes-desktop (14,079 stars, last pushed 8d ago), licensed MIT. It adds 1,250 tokens to every session, about $0.0063 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.