pubky-app AGENTS.md

Repository-specific development rules for Pubky App, a decentralized social application that works locally first and uses browser storage. They define how the interface, business logic, services, data models, and stores are allowed to interact.

In plain words
What is it for?
Use them when adding or changing Pubky App features, especially controllers, services, application logic, data storage, and UI code. They guide where code belongs and which module may call another.
Why use it?
They prevent code from bypassing the project’s architecture or creating unwanted side effects. They also make imports and responsibilities more predictable as the codebase grows.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/pubky/pubky-app/agents-md
Clone the repo
git clone --depth 1 https://github.com/pubky/pubky-app

Made for: Codex, OpenCode.

Per session 1,657 This file is loaded in full into every session.
When invoked 1,657 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01657 $0.01657
Opus 5 $0.00829 $0.00829
Sonnet 5 $0.00331 $0.00331
Haiku 4.5 $0.00166 $0.00166

Measured 3d ago against content hash 7e60d9030394, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

pubky-app AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 77 lines

How it starts

The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Pubky App

Decentralized social app. Tech stack in package.json. Local-first architecture with Dexie (IndexedDB), Zustand, Next.js, Tailwind CSS, Shadcn UI.

Architecture

Layered architecture in src/core/ (see docs/architecture.md for full details):

UI (user actions) → Controllers → Application → Services → Models
Coordinators (system) ↗            ↓              ↓
                       Stores     Pipes         Database

Import modules through the path aliases in tsconfig.json (for example @/hooks/*, @/controllers/*, @/services/*, @/models/*, @/stores/*). Keep imports pointed at concrete source modules rather than aggregate re-export files.

Hard constraints

  • Controllers NEVER call Services directly — go through Application
  • Coordinators NEVER call Application — go through Controllers
  • Application NEVER accesses Stores — only Controllers manage stores
  • Pipes are pure — NO IO, NO side effects
  • Only PostApplication, NotificationApplication, BootstrapApplication, MigrationApplication, HotApplication, PostStreamApplication, TtlApplication may call other Applications (max depth 1 by default; only PostApplication/NotificationApplication/TtlApplication → PostStreamApplication → FileApplication attachment persistence may reach depth 2; no cycles)

Controller naming

  • fetch* — network only, no cache
  • get* — local only
  • getMany* — bulk local reads, returns Map<Pubky, T>
  • getOrFetch* — local first, network fallback
  • getMany*OrFetch — bulk local first, fetch missing (e.g., getManyTagsOrFetch)
  • commitCreate* / commitUpdate* / commitDelete* — optimistic local write + network sync
  • subscribe* — long-lived live stream subscription (e.g., homeserver event streams), not a one-shot fetch

Errors

Use Err.* factories (never raw Error). Factories log automatically — don't double-log. See docs/error-handling.md.

Key conventions

  • Composite post IDs: author:postId format
  • Local-first writes: Dexie first, homeserver sync in background
  • Shadcn First: always check for Shadcn equivalent before building custom UI
  • Atomic design: atoms → molecules → organisms → templates
  • Components: do not add index.ts / index.tsx under src/components that only re-export children; import concrete component files via @/atoms/*, @/molecules/*, @/organisms/*, or @/templates/* (for example @/atoms/Button/Button)
  • Config: import from @/config/<module> (concrete files under src/config/). There is no aggregate src/config/index.ts.
  • App routes: import route enums, maps, and helpers from @/app/routes (src/app/routes.ts); prefer that over route-only imports through a re-export entrypoint.
  • Z-index scale: -z-10, z-10, z-30, z-40, z-50, z-60 (see docs/z-index.md)
  • Icons: stock Lucide from lucide-react; custom/brand SVG components from @/icons (src/libs/icons/icons.tsx via tsconfig path alias). URL→icon helpers (getIconFromUrl, getLabelFromUrl, …) live in @/libs/utils/urlToIcon — see docs/components.mdIcons (Lucide and custom).
  • Visual regression tests (VRT): surfaces with a sibling *.vrt.test.tsx (e.g. src/components/templates/Feed/Home/Home.vrt.test.tsx) have a pixel baseline checked in under __screenshots__/. When you change a UI surface, check whether a VRT exists next to it. If yes, the baseline likely needs regenerating — surface that to the user before reporting the task done. If you're touching a template-level surface that has no VRT yet, mention adding one as an option. The VRT harness lives in src/test-utils/vrt.tsx; fixtures in src/test/fixtures/; deterministic mocks in src/test/mocks/.
  • Forms (standard): build new forms with react-hook-form + zod (via @hookform/resolvers/zod). Wrap field components with Controller (use the ControlledInputField / ControlledTextareaField molecules where applicable). Keep the schema + types + defaults in a sibling *.types.ts file next to the hook (see src/hooks/useCreateCollection/useCreateCollection.types.ts for the canonical layout). Components must not call controllers directly — wrap the mutation in a hook (use{Action}Form or use{Verb}{Entity}) that returns { form, submit, reset, ... }, where submit() returns Promise<boolean> so the caller can decide what to do on success (a form hook may instead return the created entity id as Promise<string | null> when the caller needs to navigate to it, e.g. useCreateCollection). Non-text inputs (file pickers, rich text, etc.) live in their own dedicated hooks (e.g. useCoverImagePicker) and the form hook composes them. Schemas carry their user-facing validation messages as literal US English strings.
  • Memoization: do not add useCallback / useMemo — the React Compiler (reactCompiler: true in next.config.ts) handles memoization. Reach for them only after profiling proves the compiler missed something.
  • Toasts: use toast() from @/molecules/Toaster/use-toast with variant (default | error | warning | info). No showErrorToast wrappers or className destructive hacks. See docs/components.mdToasts.

Read the full file on GitHub · 77 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 77 lines · 1,657 tokens per session scan A 7e60d9030394

Subscribe to this mod's changes

pubky-app AGENTS.md is an instructions file published in the GitHub repository pubky/pubky-app (23 stars, last pushed 5d ago), licensed MIT. It adds 1,657 tokens to every session, about $0.0083 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.