graphone AGENTS.md

Repository instructions for Graphone, a visual desktop wrapper around pi-mono, including its agent workflow, project structure, build commands, and file-handling rules.

In plain words
What is it for?
Use them when developing Graphone, checking pi-mono for related features, building the project, or preparing commits while keeping local documentation changes untracked.
Why use it?
They help a coding agent find existing implementations and follow project-specific rules before changing the code or creating commits.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/prinova/graphone/agents-md
Clone the repo
git clone --depth 1 https://github.com/PriNova/graphone

Made for: Codex, OpenCode.

Per session 2,832 This file is loaded in full into every session.
When invoked 2,832 The same file — it is already loaded in full.
Security scan D 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02832 $0.02832
Opus 5 $0.01416 $0.01416
Sonnet 5 $0.00566 $0.00566
Haiku 4.5 $0.00283 $0.00283

Measured 2d ago against content hash b49a4f9127be, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

graphone AGENTS.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

| `makensis.exe: No such file` | `sudo apt install nsis` or use `build:windows:exe` |

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

- Requires **bun**: `curl -fsSL https://bun.sh/install | bash`

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Requires **bun**: `curl -fsSL https://bun.sh/install | bash`
AGENTS.md · 217 lines

How it starts

The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Graphone - Agent Quick Reference

Agent Workflow Guidelines

  • Check local code first - Before using GitHub tools (read_github, search_github, etc.), always explore the local codebase using standard file tools (read, bash with find/grep, etc.)
  • Check pi-mono first for feature implementations - Since graphone is a visual wrapper around pi-mono, look up implementations in local ../pi-mono first (when available). Many features already exist there and can be mimicked or adapted for desktop UI
  • Use GitHub tools only when you need to reference external repositories or when explicitly asked about remote code
  • Do not track or push docs/ changes - The docs/ folder and all files under it are local-only in this repo context. Do not git add/commit/push anything in docs/ (including with git add -f) unless the user explicitly overrides this rule in the current task.
  • Use title + body commit messages by default - Unless the user explicitly requests otherwise, write commits with a concise title and a descriptive body (not title-only).
  • Use robust multiline commit messages - Do not embed literal \n in a single git commit -m string. Use multiple -m flags (one per paragraph) or git commit -F with a heredoc/file so line breaks render correctly on GitHub.
  • PAT push hygiene - If pushing with GITHUB_PAT, pass it via git auth headers/env only; never echo, print, or otherwise expose the token in commands/output.
  • Default autonomous iteration guidance - For general coding-agent-first execution patterns (tests, TDD/debug loops, logs, traces, artifacts, contracts, smokes, escalation), see docs/agent-first-autonomous-iteration-playbook.md
  • Visual verification uses readiness loops, not fixed sleeps - Follow the global workflow bash -> readiness loop -> take_screenshot -> bash cleanup. The readiness wait must happen inside the startup bash call because screenshot tools cannot run until that tool call returns.
  • Do not start and stop dev helpers in parallel - Startup and cleanup are separate sequential tool calls, with take_screenshot between them. Running start-dev-and-wait.sh and stop-dev.sh in parallel is invalid and defeats the workflow.
  • Prefer project helper scripts for visual checks - For Graphone, use tooling/scripts/start-dev-and-wait.sh and tooling/scripts/stop-dev.sh instead of rewriting startup/cleanup loops inline.

Read the full file on GitHub · 217 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 217 lines · 2,832 tokens per session scan D b49a4f9127be

Subscribe to this mod's changes

graphone AGENTS.md is an instructions file published in the GitHub repository PriNova/graphone (88 stars, last pushed 2mo ago), licensed MIT. It adds 2,832 tokens to every session, about $0.0142 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.