BootAgent AGENTS.md

Project instructions for developing BootAgent, a Go and Wails desktop application with a React interface. They describe its folders, configuration, installation, security, and frontend-backend boundary.

In plain words
What is it for?
Use them when changing BootAgent services, configuration, profiles, installers, MCP integrations, generated bindings, or the desktop frontend.
Why use it?
They give contributors shared rules for where code belongs and what must be updated when interfaces change.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/maimorylab/bootagent/agents-md
Clone the repo
git clone --depth 1 https://github.com/MaimoryLab/BootAgent

Made for: Codex, OpenCode.

Per session 2,445 This file is loaded in full into every session.
When invoked 2,445 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02445 $0.02445
Opus 5 $0.01222 $0.01222
Sonnet 5 $0.00489 $0.00489
Haiku 4.5 $0.00245 $0.00245

Measured yesterday against content hash 04157c0043c6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

BootAgent AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 173 lines

How it starts

The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.

BootAgent 开发约定

当前代码线是 Go/Wails 稳定化主线。不要在本文硬编码发布版本;发布版本以 Git tag、 GitHub Release 和构建工作流注入的版本为准。唯一产品入口是 cmd/bootagent-desktop,React 只能通过生成的 Wails bindings 调用后端。

目录

  • internal/app:Status、Provider、Agent、Profile、Runtime、DesktopAgent、安装、 启动、设置和更新等用例,以及统一的写操作锁。
  • internal/catalog:嵌入的 agents.lock.jsonproviders.lock.jsonruntimes.lock.json,以及内置 Provider 目录。
  • internal/config:TOML/JSON/JSONC 适配器、配置发现和 golden fixtures。
  • internal/install:默认安装最新版或可选精确版本的 Agent 包、registry 选择、 Node.js/uv runtime 引导(下载、校验、解压和 PATH 更新),以及 Aider 的 Python 管理边界。
  • internal/profileinternal/securefs:Profile、密钥、备份、权限和原子写入。
  • internal/mcp:MCP 规范化模型、秘密处理、Registry 私有存储、导入导出,以及 Claude Code、Codex、OpenCode、Kilo CLI 和 Hermes 原生配置适配器。
  • internal/binding:React 与 Go 之间唯一的边界。Services 聚合 Status、Provider、 Agent、Profile、Runtime、DesktopAgent、Transfer 和 MCP 八个服务;UpdateService 在桌面 入口中单独注册。这里的 DTO 发生变化时,必须重新生成 frontend/bindings,并同步 frontend/src/backend/wails.tsfrontend/src/types/api.ts
  • cmd/bootagent-desktop:Wails 桌面入口。
  • frontend/bindings:Wails 生成文件,禁止手工编辑。

cmd/bootagent-releasecmd/bootagent-rccmd/bootagent-provider-smoke 已在 23805b0 删除,其职责转移到 .github/workflows/build-artifacts.yml。历史文档中 出现这些命令只代表背景,不是可执行指令。

公共站点已迁移到 MaimoryLab/BootAgent-site,本仓库不再 包含 site/。站点把发布 tag 中的 agents.lock.jsonproviders.lock.json 复制到 自己的 data/ 目录;发布完成后,构建工作流会通知站点刷新。直接修改本仓库的 main 不应立即改变站点,因为站点描述的是已发布版本支持的内容。

providers.lock.json 是内置 Provider endpoint、fallback model 和公共站点商业披露 字段的唯一事实来源。用户 Provider 与内置 Provider 覆盖项保存在 ~/.bootagent/providers.json

本地命令

go test ./...
go test -race ./...
go vet ./...
python3 -m unittest scripts/test_generate_third_party_licenses.py
python3 scripts/generate_third_party_licenses.py --check
python3 scripts/check-docs.py
cd frontend
pnpm install --frozen-lockfile
pnpm run test
pnpm run build
pnpm run test:e2e

.github/workflows/ci.yml 在 pull request 与 main push 上运行四组门禁:Go、 Frontend、Docs 和 Release compliance。Go 门禁还运行 staticcheck

Read the full file on GitHub · 173 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 173 lines · 2,445 tokens per session scan A 04157c0043c6

Subscribe to this mod's changes

BootAgent AGENTS.md is an instructions file published in the GitHub repository MaimoryLab/BootAgent (96 stars, last pushed 4d ago), licensed Apache-2.0. It adds 2,445 tokens to every session, about $0.0122 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.