agentpack AGENTS.md

Repository instructions for agentpack, a Rust command-line tool that pins GitHub-hosted skills, plugin folders, and plugin marketplaces for a project. It explains the project manifest, lockfile, user-wide storage, staging, and contribution rules.

In plain words
What is it for?
Working on agentpack's source code, dependency resolution, lockfiles, local storage, staging, harness-specific code, and pre-release changes.
Why use it?
They help agents understand exactly where dependencies come from and how versions are recorded, while warning that this pre-release tool may change in incompatible ways.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/oleghq/agentpack/agents-md
Clone the repo
git clone --depth 1 https://github.com/OlegHQ/agentpack

Made for: Codex, OpenCode.

Per session 10,862 This file is loaded in full into every session.
When invoked 10,862 The same file — it is already loaded in full.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.10862 $0.10862
Opus 5 $0.05431 $0.05431
Sonnet 5 $0.02172 $0.02172
Haiku 4.5 $0.01086 $0.01086

Measured 2d ago against content hash 81e59ac9189e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

agentpack AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

| **User** | **`~/.claude/settings.json`**, **`~/.claude.json`** (plus preferences, OAuth, MCP entries, and per-project UI state in the latter) |
AGENTS.md · 294 lines

How it starts

The opening of the file, as written. The whole thing — 294 lines — stays where its author put it; the contents beside it link to each section on GitHub.

agentpack

agentpack is a Rust CLI that pins GitHub-hosted skills, plugin directories (.claude-plugin, .cursor-plugin, and/or .codex-plugin), and single-plugin marketplace repositories for a project.

Source of truth for what to install is agentpack.toml at the repo root (direct dependencies, project-local modes, and MCP settings). pack.lock (v2) lists every resolved package (direct and transitive from nested agentpack.toml files inside dependencies) with pinned commits and cache_keys. Both files live in the project repo.

All downloaded trees, the RedDB index, and your local/ mirror live under a user-wide agentpack home (see below)—not under a repo-local .agentpack/ directory. Staging for harnesses still uses a per-project temp directory (or AGENTPACK_STAGING_ROOT).

Pre-release

No backwards compatibility. agentpack is pre-release: CLI behavior, lockfile shape, staging layout, env vars, and defaults may change without a migration period or deprecation window. Assume breaking changes between versions until a stable release is declared.

Code structure (contributor rule)

Per-harness code lives in src/harness/<name>/. Shared code lives in its subsystem. No re-export shims, no orphaned glue. No single-file folders except the uniform harness folders, no <40-line orphan modules.

  • One folder per harness, uniformly. Each coding agent is a folder src/harness/<name>/ with mod.rs (+ submodules as needed) implementing the Harness trait — even small harnesses (grok/, agy/) are folders, so the layout is identical for all six. Everything used by only that one harness lives there — seed, attribution writer, MCP-config writer (including codex/grok's own copy of the [mcp_servers] TOML writer), hook renderer + support fn, credential bridging (codex/auth.rs), fake-home (cursor/fake_home.rs), workspace overlays, and launch_command. To understand or add a harness you read/create one folder, nothing else. The only files at harness/ root are the shared harness system: mod.rs (trait + registry + contexts), target.rs (HarnessTarget), launch.rs (launch dispatch).
  • Shared infrastructure stays in its subsystem and never holds per-harness logic: staging/ = cross-harness staging passes (pack_overlay, collision, guidance collection, dot_agents, mcp collect+merge, pipeline) plus the shared keep_attribution/NO_ATTRIBUTION_BODY primitives; hooks/ = the hook engine (ir, collect, parse, stage, render trait + SupportLevel, runtime/{bridge,dispatch,handlers,output}); artifacts/ = artifact rendering; fs_util.rs = generic file-tree helpers (copy_selected_entries, copy_merge_tree). A file named after a harness (cursor.rs, parse/claude.rs) sitting in a shared subsystem is a smell — colocate it or, if it's actually a shared format adapter, name it for the format not the harness.
  • No single-file folders, no tiny orphans. A module is a flat foo.rs unless it has real internal structure (the uniform harness folders are the one deliberate exception). A <40-line helper used by ≥2 modules lives in its natural home (its trait file, its caller, or fs_util), not in a file of its own. API-surface pub use in a subsystem mod.rs (e.g. sync, github) is a module boundary, not a shim — those stay.
  • One canonical home per type; no re-export shims. HarnessTarget is defined only in src/harness/target.rs and imported everywhere as crate::harness::HarnessTarget — there are no pub use …::HarnessTarget chains through artifacts/staging/sync/hooks::ir. Don't add a re-export to "keep an old path resolving"; repoint the callers.
  • No orphaned glue modules. Launch dispatch + shared launch helpers live in harness/launch.rs (called via harness::launch), not a separate top-level launcher/. If a module exists only to forward to another, delete it and inline the call.
  • The trait owns per-harness divergence; genuinely cross-harness passes that take "all roots at once" (pack_overlay, guidance, collision) stay shared loops. Adding a 7th harness should mean: one new src/harness/<name>/ + one line in harness::all() + one HarnessTarget variant + one cli subcommand.

Read the full file on GitHub · 294 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 294 lines · 10,862 tokens per session scan B 81e59ac9189e

Subscribe to this mod's changes

agentpack AGENTS.md is an instructions file published in the GitHub repository OlegHQ/agentpack (14 stars, last pushed 13d ago), licensed MIT. It adds 10,862 tokens to every session, about $0.0543 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.