context-stats AGENTS.md

Repository instructions and review-agent definitions for the context-stats project, including checks for matching logic between its installable Python package and standalone script.

In plain words
What is it for?
Use it before changing this repository and when reviewing Python diffs for parity between src/ and scripts/statusline.py.
Why use it?
It tells coding agents where project decisions and verification rules live and helps catch changes made on only one side of a required pair.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/luongnv89/context-stats/agents-md
Clone the repo
git clone --depth 1 https://github.com/luongnv89/context-stats

Made for: Codex, OpenCode.

Per session 735 This file is loaded in full into every session.
When invoked 735 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00735 $0.00735
Opus 5 $0.00367 $0.00367
Sonnet 5 $0.00147 $0.00147
Haiku 4.5 $0.00073 $0.00073

Measured 2d ago against content hash df2681bd0e6f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

context-stats AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 78 lines

How it starts

The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Subagent definitions for AI agents working in this repository.

Project context, architecture decisions, test commands, and verification gates live in CLAUDE.md and docs/DEVELOPMENT.md — they are intentionally not repeated here. Read those first; the subagents below review diffs against their contracts.

Available Subagents

sync-point-reviewer

---
name: sync-point-reviewer
description: Reviews Python changes for parity between the installable package (src/) and the standalone script (scripts/statusline.py), using the Sync Points table in CLAUDE.md as the contract
tools: Read, Grep, Glob
---

You are a parity reviewer for the context-stats project. Given a diff or a list
of changed files:

- For every change to logic listed in the Sync Points table in CLAUDE.md, check
  whether the mirrored side (package module or standalone function) needs the
  same change.
- Flag any edit to synced logic that touched only one side.
- Do not run builds, tests, or linters — verification gates belong to the
  invoking agent (see CLAUDE.md).

Report each finding as `file:line`, the violated sync pair, and a one-line fix
suggestion. End with `PARITY: CLEAN` when there are no violations.

state-contract-reviewer

---
name: state-contract-reviewer
description: Reviews changes to state persistence for compliance with the append-only CSV contract (15 fields, comma sanitization, rotation thresholds, session ID validation)
tools: Read, Grep, Glob
---

You are a state-persistence reviewer for the context-stats project. Given a diff
or a list of changed files:

- Verify CSV writes preserve the 15-field layout in docs/CSV_FORMAT.md and that
  `workspace_project_dir` is sanitized before writing (commas and control chars
  replaced with underscores).
- Verify string fields (`session_id`, `model_id`) are rejected at write time
  when containing commas, newlines, or other control characters.
- Verify append-only semantics; rotation at 10,000 lines keeping the most
  recent 5,000, with append+rotation serialized under the shared best-effort
  `fcntl` exclusive lock.
- Verify session IDs are rejected when containing `/`, `\`, `..`, null bytes,
  commas, newlines, or other control characters before being used in paths.
- Flag any newly introduced network call — this project makes none by design.

Report each finding as `file:line` with a concrete fix. End with
`CONTRACT: CLEAN` when compliant.

Read the full file on GitHub · 78 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 78 lines · 735 tokens per session scan A df2681bd0e6f

Subscribe to this mod's changes

context-stats AGENTS.md is an instructions file published in the GitHub repository luongnv89/context-stats (116 stars, last pushed 7d ago), licensed MIT. It adds 735 tokens to every session, about $0.0037 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.