Borrowing it
Nothing to install: this file belongs to sstraus/tuicommander. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sstraus/tuicommander/main/AGENTS.mdgit clone --depth 1 https://github.com/sstraus/tuicommanderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/sstraus/tuicommander/agents-md)<a href="https://agentmods.dev/instructions/sstraus/tuicommander/agents-md"><img src="https://agentmods.dev/badge/instructions/sstraus/tuicommander/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/sstraus/tuicommander/agents-md"><img src="https://agentmods.dev/badge/instructions/sstraus/tuicommander/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.14314 | $0.14314 |
| Opus 5.5 | $0.05726 | $0.05726 |
| Sonnet 5.5 | $0.02863 | $0.02863 |
| Haiku 4.5 | $0.01431 | $0.01431 |
Grade B, and why
tuicommander AGENTS.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST http://localhost:9876/diagnostics -d '{"enabled":true}' -H 'Content-Type: application/json' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
3. **CLI probing** — `curl` HTTP endpoints, `grep` for patterns How it starts
The opening of the file, as written. The whole thing — 638 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TUICommander — Project Rules
Doc Sync
Read docs/sync-matrix.md before any feature/API/config change — it maps code areas to docs that MUST be updated.
Tests
-
Run standalone Rust, Vitest, and plugin test commands through
scripts/with-test-tmp.sh;make check,make test-shell,make cov, andmake mutantsset their own repository-local test temp root. This does not apply tomake devorcargo run. -
Bare
cargo testRust test binaries initializeTMPDIR,TMP, andTEMPfromTUIC_TEST_TMP_ROOTor this checkout's.tmp/tuic-testsbefore libtest starts; Nextest does the same for every test binary through.config/nextest.tomlsetup scripts. New Rust tests must usetest_temp_root()or assert their scratch paths stay inside it. Neither mechanism changesmake devorcargo run. -
Test only the changed behavior. Routine validation MUST use the narrowest test filters that cover the production code, protocol surface, fixtures, or test support changed by the task. Do not run full-crate, full-app, full-tree, or unrelated suites merely for reassurance; they waste shared build time and obscure relevant evidence. Expand beyond targeted tests only when a documented gate explicitly requires it, targeted evidence proves a cross-cutting risk, or Boss explicitly asks for the broader run.
-
Tests are the spec. When a test fails after a code change, investigate BOTH sides before deciding which to fix.
-
Finding a story partially implemented does NOT mean it's done. When you pick up a story and discover the feature already exists, verify EVERY part of the story is honored — each acceptance criterion, edge case, and requirement — before marking it complete. Never assume the whole story is satisfied just because one part is implemented. Check each criterion against the code and prove it, or the story isn't done.
-
to-test.mdtracks features awaiting manual testing — add items there for minor features. -
Mutation testing is per change, never per tree.
make mutants RANGE=<base>(defaultHEAD~1) runs cargo-mutants--in-diffover the Rust lines the range touched,--in-placein a disposablegit archiveexport under.tmp/(not a worktree: a detached worktree is an orphan to the running app, which removes it), one job, through mbx. Every viable mutant costs one incremental build of the lib crate plus one test run, so the orchestrator runs it once per batch on the final HEAD — agents do not. A surviving mutant is a missing test: add the test, or#[mutants::skip]with the reason on the line. Measured 2026-09-06: baseline 197 s build + 224 s test with warm deps; each mutant ~3 min incremental build of the lib crate plus 0.5–3.5 min of tests, so ~5 min each and a 38-mutant story diff is ~3 h. During the day pass a function filter through the script (scripts/mutants.sh HEAD~1 --re <function>); the whole diff is an overnight or CI job. Config insrc-tauri/.cargo/mutants.toml, mechanics inscripts/mutants.sh. -
Function-filtered mutation runs through make can use
make mutants RANGE=<base> -- --re <function>; useMUTANTS_ARGS='--re <function>'for filters containing spaces or other complex arguments. -
[HUMAN]is a last resort. Before marking a to-test item[HUMAN], you MUST attempt verification through this escalation ladder:- Code inspection — read the source, confirm the logic exists at file:line
- Test execution —
cargo nextest run(doctests:cargo test --doc),vitest runwith relevant filter - CLI probing —
curlHTTP endpoints,grepfor patterns - MCP maccontrol — take screenshots, click UI elements, verify visual state
- MCP invoke/JS — call Tauri commands, inspect store state, trigger actions programmatically
Only use
[HUMAN]when the item genuinely requires real hardware (audio, IME, touch), multi-app interaction (drag to Finder, global hotkey from another app), or timing-sensitive observation that none of the above can capture. When code-verifying, change[HUMAN]to[x]with a_(verified: file:line explanation)_annotation. When code reveals the description is wrong, change to[ ]with a_(NOTE: ...)_correction.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +3 lines · +177 tokens per session 1dc65e3e41af
- 6d ago Changed · +27 lines · +637 tokens per session e0bc9c29f010
- 10d ago Changed · +11 lines · +242 tokens per session a98c5d5dc9ce
- 17d ago Changed · +7 tokens per session cbca9ecdd8c0
- 22d ago Changed · +1 lines · +57 tokens per session 5c26e8e78809
- 23d ago Changed · +84 lines · +1,745 tokens per session bbbb868b4b0f
- 1mo ago Changed · +196 lines · +4,656 tokens per session 49f68da9afe8
- 1mo ago Changed · +7 lines · +96 tokens per session 3d070054642f
- 1mo ago First seen · 309 lines · 6,697 tokens per session scan B 21dbcad0c83e
tuicommander AGENTS.md is an instructions file published in the GitHub repository sstraus/tuicommander (166 stars, last pushed yesterday), licensed Apache-2.0. It adds 14,314 tokens to every session, about $0.0573 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
vscode model-prompts.instructions.md
Model-specific prompt authoring and registry guidelines.