hitkeep AGENTS.md

A repository guide for coding agents and contributors working on HitKeep. It explains the project structure, important rules, and the recommended development workflow.

In plain words
What is it for?
Use it when changing HitKeep, finding where code belongs, following its contributor process, or using its developer tools.
Why use it?
It gives contributors a shared source of truth when issues, older documents, and the current code disagree. It also helps keep agent instructions consistent.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/pascalebeier/hitkeep/agents-md
Clone the repo
git clone --depth 1 https://github.com/PascaleBeier/hitkeep

Made for: Codex, OpenCode.

Per session 3,010 This file is loaded in full into every session.
When invoked 3,010 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03010 $0.03010
Opus 5 $0.01505 $0.01505
Sonnet 5 $0.00602 $0.00602
Haiku 4.5 $0.00301 $0.00301

Measured yesterday against content hash a95077ce0541, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

hitkeep AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 146 lines

How it starts

The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.

HitKeep Agent Guide

This file is public guidance for AI-assisted contributions to HitKeep. It is written for external contributors, maintainers, and coding agents working from the open-source repository.

CLAUDE.md is a compatibility bridge for Claude Code. Keep AGENTS.md as the canonical public instruction file and avoid duplicating the full guide in multiple places.

Start Here

  • Treat the current repository as the source of truth. If an issue, prompt, or older document disagrees with the code, inspect the code first.
  • Use ./hk as the workflow source of truth, but consume that truth through the callable central developer MCP tools on its compact surface whenever they cover the task. Reserve direct CLI discovery for MCP bootstrap or repair, explicitly approved fallback, and workflows intentionally absent from MCP such as source rewrites; never copy commands, runtime configuration facts, build tags, cloud defaults, ports, tool versions, or QA gates into instructions.
  • Treat developer MCP as available only when the relevant hk_* tools are exposed and a read-only call succeeds; a configured or enabled host entry is not proof. Register one long-lived clone's locally built ./hk launcher once, query ./hk mcp manifest --output json only for the live bootstrap contract, and verify the returned workspace ID against the configured fallback or server catalog. If tools are absent or fail, inspect host MCP health, compare the registration with the manifest, report whether registration, startup, workspace routing, or task reload is blocking use, and obtain explicit user approval before invoking an equivalent versioned ./hk --output json action. When that fallback is approved, ./hk catalog configuration --output json is the structured runtime configuration documentation contract. Existing tasks may require a host reload before newly registered tools appear; reserve human output for people.
  • Inspect the current workspace before setup, services, builds, or QA. Reuse an active run instead of starting duplicate work.
  • Development is one container-only session per workspace. It has status and event cursors, not a run ID. Setup, QA, builds, and smokes remain finite runs.
  • Use the developer CLI's formatter and Go migration surfaces for deliberate source rewrites. QA and MCP checks must remain non-mutating.
  • Keep changes small and tied to the user-visible behavior or maintenance task being requested.
  • Do not include credentials, customer data, private deployment details, local machine paths, or screenshots that reveal private analytics.
  • Preserve HitKeep's product shape: one deployable application, clear operator controls, and no unnecessary service dependencies.

Read the full file on GitHub · 146 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 146 lines · 3,010 tokens per session scan A a95077ce0541

Subscribe to this mod's changes

hitkeep AGENTS.md is an instructions file published in the GitHub repository PascaleBeier/hitkeep (85 stars, last pushed 2d ago), licensed MIT. It adds 3,010 tokens to every session, about $0.0151 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.