Borrowing it
Nothing to install: this file belongs to popstas/windows-mqtt. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/popstas/windows-mqtt/master/AGENTS.mdgit clone --depth 1 https://github.com/popstas/windows-mqttWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/popstas/windows-mqtt/agents-md)<a href="https://agentmods.dev/instructions/popstas/windows-mqtt/agents-md"><img src="https://agentmods.dev/badge/instructions/popstas/windows-mqtt/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/popstas/windows-mqtt/agents-md"><img src="https://agentmods.dev/badge/instructions/popstas/windows-mqtt/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.04979 | $0.04979 |
| Opus 5.5 | $0.01992 | $0.01992 |
| Sonnet 5.5 | $0.00996 | $0.00996 |
| Haiku 4.5 | $0.00498 | $0.00498 |
Grade A, and why
windows-mqtt AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 286 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS Instructions
This repo contains a Node.js project for controlling a PC via MQTT, wrapped in a Tauri v2 desktop app.
Environment
Run source "$HOME/.cargo/env" before any cargo/rust commands.
ESM-соглашения
Весь JS в проекте — ES-модули ("type": "module" в package.json). При правке кода:
- Относительные импорты обязаны нести расширение
.js(./foo.js, не./foo). - CJS-зависимости импортируются дефолтом и деструктурируются
(
import pkg from 'x'; const { thing } = pkg;), а не именованными импортами — именованные экспорты из CJS зависят отcjs-module-lexer, который ненадёжен на пакетах с нативными аддонами. - Если у зависимости в
exportsесть ключrequire, но нетimport, голыйimportуходит вdefaultи может отличаться от того, что отдавалrequire()— именно так одна строка молча сменила протокол OBS на msgpack вместо JSON (src/modules/obs.js, обходится импортом подпутиobs-websocket-js/json). Перед переводом любой зависимости стоит сверитьimport.meta.resolve('pkg')с прежнимrequire.resolve('pkg'). - Тот же механизм уже стоил второго модуля:
wsпод ESM резолвится вwrapper.mjs, чейdefault— классWebSocketБЕЗ статик, поэтомуnew WebSocket.Server()изsrc/modules/tabs.jsпадал с TypeError с самого перехода на ESM (глоталinitModules()). Сервер берётся только именованным импортомimport { WebSocketServer } from 'ws'—wrapper.mjsнастоящий ESM, оговорка проcjs-module-lexerк нему не относится. require()в проекте больше нет.- Планка рантайма:
import.meta.dirnameтребует Node ≥ 20.11 (боевой код),registerHooks— Node ≥ 22.15 (только тесты,test/modules-registry.test.js). Поляenginesвpackage.jsonнамеренно нет. data/под.gitignoreи содержит CommonJS-файлы (data/index.jsи т. п.), поэтому там лежит собственныйdata/package.jsonс{"type":"commonjs"}— на свежем клоне его надо создать заново.
Tauri Architecture
- Tauri v2 (not v1, not Electron). Config schema:
https://schema.tauri.app/config/2 - Rust backend in
src-tauri/src/main.rs— resolves an "app root" (dev: project root; bundled:resource_dir/_up_) viaresolve_app_root, spawns the Node.js server fromsetup()as a child process viatauri-plugin-shell, and kills it gracefully on Quit (sendsapp/shutdownIPC action, then hard-kills after 800ms) - Permissions defined in
src-tauri/capabilities/default.json(replaces v1allowlist) - Tray icon built inside
.setup()usingTrayIconBuilder, withon_menu_eventandon_tray_icon_eventclosures - Shell commands use
app.shell().command()(fromShellExttrait), NOTtauri::api::process::Command CommandEvent::Stdout/StderrreturnsVec<u8>, convert withString::from_utf8_lossy- Build check:
cd src-tauri && cargo check - Типы без TypeScript:
jsconfig.jsonвключаетcheckJs,npm run typecheck(tsc --noEmit) гоняется первым шагомnpm test. Файлы остаются.js, шага сборки нет —bundle.resources,deploy-fast.jsи спавнsrc/index.jsиз Rust продолжают работать с россыпью исходников.strictнамеренно выключен: в нём проект даёт ~450 ошибок, из них ~380 — разметка implicit any без единого реального дефекта. Формы конфига описаны одним@typedef Configвsrc/config-loader.js(индексная сигнатура: ключи задаёт пользователь в YAML). Нетипизированные зависимости обязаны иметь@types/*в devDependencies — иначеallowJsзаставляетtscпроверять их собственный JS и сыпать сотней чужих ошибок. - JS tests:
npm test(npm run typecheck && node --test test/**/*.test.js). Pure logic only — never spawn Windows/native binaries in tests. Modules with native addons are covered bytest/native-modules.test.js, which auto-skips where those addons aren't installed (e.g. Linux). - JS/Rust config-path coupling:
resolveAppFile/resolveConfigPathinsrc/paths.jsmust stay in sync withconfig_candidates/resolve_config_pathinsrc-tauri/src/main.rs(same search order, sameconfig.example.ymlfallback). - JS/Rust MQTT-address coupling:
parseBroker/connectArgsinsrc/mqtt-broker.js(headless client) andparse_broker/tls_roots_forinsrc-tauri/src/mqtt_bridge.rs(Tauri bridge) read the samemqtt.host/mqtt.port/mqtt.caand must agree: barehost[:port]= plain mqtt,mqtts://= TLS, port from the address >portkey (a number or a numeric string) > 1883/8883, anything else is a config error; relativecaresolves against the config.yml folder. The rule is shared with ccfzf-picker and windows11-manager. Both test files carry the same case list — change them together. Rust TLS useswebpki-roots, notTlsConfiguration::default()(it loads the lazily-filled Windows store and panics on failure);rustlsmust stay on the version rumqttc pulls (0.22 for rumqttc 0.24). - Dev run:
npm run start-tauriorcargo tauri dev. The npm scripts usescripts/tauri-wrapper.jsto ensure MSVC linker is available when running from Git Bash (vcvars64.bat is invoked before Tauri). If you seeLNK1181: cannot open input file 'kernel32.lib', ensure the "Desktop development with C++" workload includes the Windows 10/11 SDK.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago Changed · +17 lines · +614 tokens per session 8a4260184514
- 2mo ago First seen · 269 lines · 4,365 tokens per session scan A b46b5f886b60
windows-mqtt AGENTS.md is an instructions file published in the GitHub repository popstas/windows-mqtt (10 stars, last pushed 20d ago), licensed MIT. It adds 4,979 tokens to every session, about $0.0199 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
windows-mqtt AGENTS.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| windows-mqtt AGENTS.mdpopstas/windows-mqtt | Instructions file | 10 | 20d ago | MIT | A | 4,979 | Codex, OpenCode |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | yesterday | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |