akm AGENTS.md

A repository guide for AKM, a Bun-based command-line application. It describes the project structure, development workflow, build output, formatting, and test commands.

In plain words
What is it for?
Use it to install dependencies, inspect the CLI architecture, format and lint code, run type checks and unit or integration tests, build the package, and verify only changed areas.
Why use it?
It tells coding agents which checks and focused tests to run and prevents common mistakes such as generating test files in the distribution folder.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/itlackey/akm/agents-md
Clone the repo
git clone --depth 1 https://github.com/itlackey/akm

Made for: Codex, OpenCode.

Per session 2,755 This file is loaded in full into every session.
When invoked 2,755 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02755 $0.02755
Opus 5 $0.01378 $0.01378
Sonnet 5 $0.00551 $0.00551
Haiku 4.5 $0.00276 $0.00276

Measured 2d ago against content hash c96ba2da30b9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

akm AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 60 lines

How it starts

The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AKM Repo Notes

Workflow

  • Runtime and tooling are Bun-first. Use bun install.
  • CI runs bun run check, which is bun run lint && bunx tsc --noEmit && bun run test:unit && bun run test:integration.
  • Before committing, run bunx biome check --write src/ tests/. Repo guidance prefers the write-capable Biome pass, not just bun run lint.
  • Build with bun run build. It compiles src/** only into dist/; dist/tests should never appear.
  • Prefer focused verification with bun test tests/<file>.test.ts. bun run check:changed runs a small set of output/contract suites (output-baseline, registry-search, show-argv-entrypoint, output-shapes-unit) plus bun run lint and bunx tsc --noEmit.

Architecture

  • This is a CLI-only package. There is no public API, no barrel exports, and no exports map. src/cli.ts is the thin dispatcher; command implementations live under src/commands/, mostly in per-family directories (src/commands/read/, src/commands/improve/, src/commands/sources/, src/commands/env/, src/commands/tasks/, src/commands/agent/, src/commands/proposal/, src/commands/health/, src/commands/lint/), with a handful of standalone *-cli.ts files (e.g. config-cli.ts, workflow-cli.ts, migrate-cli.ts, registry-cli.ts) still at the top level.
  • If you touch providers, refs, search/show behavior, config, or output shaping, read docs/architecture/architecture.md first. tests/contracts/ pins active contracts and is meant to catch contract drift.
  • Supported source providers are locked to filesystem, git, website, and npm. Do not add context-hub; do not reintroduce openviking.
  • SourceProvider is exactly { name, kind, path, sync? }. All providers materialize files to local disk.
  • Asset refs are [bundle//]conceptId[#fragment], where conceptId is subdir-qualified within its bundle (e.g. skills/code-review, memories/vpn-note, knowledge/api-guide, env/prod). Durable state stores the fully-qualified bundle//conceptId; the short bundle-omitted form is input sugar resolved against defaultBundle, then the remaining bundles in installation-priority order. Source locators like github:owner/repo are for akm bundle add, not for asset addressing. The old [origin//]type:name grammar is gone (the frozen migrator in scripts/akm-migrate/migrate/ is the only place it survives).
  • show is local-index only: resolve through the FTS index, then read from disk. No per-provider show exists.
  • Registry results are opt-in, stay separate from normal stash hits, and live in registryHits, never hits.
  • All write-target branching by source.kind belongs in src/core/write-source.ts.
  • Write-target resolution order is --target -> defaultWriteTarget -> working stash (defaultBundle); there is no fallback to the first writable source.
  • writable defaults to true on filesystem and false on git / website / npm; writable: true on website or npm is rejected at config load.

Read the full file on GitHub · 60 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 60 lines · 2,755 tokens per session scan A c96ba2da30b9

Subscribe to this mod's changes

akm AGENTS.md is an instructions file published in the GitHub repository itlackey/akm (55 stars, last pushed 2d ago), licensed MPL-2.0. It adds 2,755 tokens to every session, about $0.0138 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.