neodx AGENTS.md

A project instruction guide for neodx, a Yarn 4 and Vite+ monorepo—a repository containing several related packages managed together.

In plain words
What is it for?
Use it when changing neodx packages or shared tooling to follow the standing-branch rule, changelog process, publish freeze, and repository-wide conventions.
Why use it?
It explains the repository's current workflow and prevents agents from using outdated release steps, extra branches, or incorrect Changeset commands.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/secundant/neodx/agents-md
Clone the repo
git clone --depth 1 https://github.com/secundant/neodx

Made for: Codex, OpenCode.

Per session 2,722 This file is loaded in full into every session.
When invoked 2,722 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02722 $0.02722
Opus 5 $0.01361 $0.01361
Sonnet 5 $0.00544 $0.00544
Haiku 4.5 $0.00272 $0.00272

Measured 3d ago against content hash 4030b02c208e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

neodx AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 166 lines

How it starts

The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.

neodx

Yarn 4 / Vite+ monorepo of everyday frontend DX instruments: SVG sprite pipeline, Figma integration, isomorphic logger, and a virtual file system, plus shared foundations and build tooling.

This file is the routing index: it keeps repo-wide constraints visible and points to the narrowest source that owns the current decision.

Session rules

These bind every session until the owner changes them.

One branch. Do the work on the standing branch work (cut over 2026-08-24 from main after strip-source-bridges landed). Do not open PRs, merge to main, or add extra branches unless the owner asks. main is landed history. Release automation on main is not everyday workflow.

Changelogs, not publishes. When a caller-visible change needs a changelog, add a Changeset with the CLI and stop there:

yarn changeset add

Docs: Changesets CLI. This repo pins @changesets/cli 2.27.1, so add takes --empty and --open. It does not take the v3 --patch / --minor / -m flags.

Publish freeze. strip-source-bridges (#180) is on npm 1.1.1 and closed. Do not publish again until the owner names a consolidated release. Queue later leftovers as Changesets on work. Do not run yarn changeset version, yarn changeset publish, merge a Version Packages PR, recreate a closed Version Packages PR, or re-run Release to push npm. The freeze exists so later work can share one release.

Session close. End every session with the session-close gate. Name any skipped check and why. Local green is not optional at close, even when CI is otherwise opt-in.

Task names. In issues, ledgers, and chat, lead with a readable slug, then the GitHub number: oxlint-typecheck (#179), not R2-f. Closed program rows may keep old stream codes as history. Live work must not.

Tighten what you touch. Config, tools, and comments have gone vague in places (stale program codes, duplicated tsconfig, dishonest overrides, dead paths, names that no longer match meaning). Every session, after the assigned slice is green, make a bounded pass over files and tools this session already opened: clarify ownership, delete dead config, collapse duplicates, and make names match meaning. Do not start a repo-wide cleanup. Do not mix this pass with pack-contract or publish work. Record leftover debt with a slug, not a silent skip. This rule outlives any one leftover.

Read the full file on GitHub · 166 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 166 lines · 2,722 tokens per session scan A 4030b02c208e

Subscribe to this mod's changes

neodx AGENTS.md is an instructions file published in the GitHub repository secundant/neodx (94 stars, last pushed 8d ago), licensed MIT. It adds 2,722 tokens to every session, about $0.0136 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.