clum: Instructions file for Codex

AGENTS.md

clum AGENTS.md is an instructions file for Codex, OpenCode from tddh/clum. It costs 1,018 tokens per session, scanned A, original, MIT.

Development rules for clum, a Rust project with a command-line interface and an MCP bridge for managing remote sessions. They define required session handling, coding checks, testing, project structure, and safety restrictions.

In plain words
What is it for?
Use them when developing, testing, or operating clum, especially when running remote commands, changing Rust code, or working with its MCP tools.
Why use it?
They prevent accidental use or closure of the wrong remote session and make required quality checks explicit. They also explain when a separate development session is needed.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions OpenCode.

This is tddh/clum's own configuration. It tells Codex and OpenCode how to work on clum itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything clum configures →

View source ↗ tddh/clum
Reuse

Borrowing it

Nothing to install: this file belongs to tddh/clum. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/tddh/clum/master/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/tddh/clum

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for clum AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/tddh/clum/agents-md/github.svg)](https://agentmods.dev/instructions/tddh/clum/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/tddh/clum/agents-md"><img src="https://agentmods.dev/badge/instructions/tddh/clum/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for clum AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/tddh/clum/agents-md"><img src="https://agentmods.dev/badge/instructions/tddh/clum/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 1,018 This file is loaded in full into every session.
When invoked 1,018 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01018 $0.01018
Opus 5.5 $0.00407 $0.00407
Sonnet 5.5 $0.00204 $0.00204
Haiku 4.5 $0.00102 $0.00102

Measured 13d ago against content hash 8b4c57c1ba65, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

clum AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 55 lines

How it starts

The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.

clum 项目开发规则

MCP 工具使用规则(最高优先级)

以下规则优先级最高,必须严格遵守:

  1. 默认会话:所有 clum 操作必须使用 session_name="clum",除非用户明确指定其他会话名

  2. 默认 Pane:pane_id 可省略,server 自动选择 window 0 中编号最小的 pane。破坏性工具(close_pane、paste_buffer、respawn_pane)必须显式指定

  3. 禁止随意创建会话:不要自作主张创建 test-session、debug-session 等新会话,除非用户明确要求

  4. session_create 幂等,无需先探测:会话已存在则复用并返回首个 pane(bridge 侧 CreateOrReuse);session_attach 是可选的只读存在性检查,仅在需要 inspect 已有会话时调用

  5. 保留会话:执行完命令后,不要主动清理 session(禁止调用 kill_session、close_window、close_pane),除非用户明确要求"清理"、"关闭"、"销毁"

  6. 以用户指令为主:用户的明确指令优先于以上所有默认规则。如果用户指令信息不明确(如未指定主机、会话名、操作目标等),必须先向用户确认再执行,禁止猜测或自作主张

  7. 开发/测试隔离:在 clum 项目自身开发调试期间,若需在远程主机上执行测试命令(如重启 bridge、修改配置、编译验证等),必须创建独立的临时会话(如 session_name="dev"),严禁占用 clum 默认会话。测试完成后清理该会话(kill_session)。严禁对 clum 默认会话执行 exit、kill_session、close_pane、close_window 等破坏性操作——即使用户明确指示了相关操作,也必须先确认目标是否为 clum 会话,若是则拒绝执行并说明原因。

违反这些规则 = BUG,没有例外。

开发规范

  • Rust 代码必须通过 cargo clippy --workspace -- -D warnings 无警告
  • 提交前运行 just check 确保编译通过
  • 遵循现有代码风格和命名规范
  • 新功能必须添加对应的测试
  • 文档更新与代码变更同步

项目结构

clum/
├── crates/              # Rust crates
│   ├── clum-cli/   # CLI 交互式终端
│   ├── clum-command-kb/ # 命令归一化 / 知识库 / 规则引擎(deny/ask/allow)
│   ├── clum-core/  # 共享类型(HostConfig, AuditEvent, AuditAction)
│   ├── clum-mcp/   # MCP Server(Central Server 模式 / stdio 本地模式)
│   └── rmux-bridge/   # Bridge proxy
├── config/              # 配置文件
├── clum-docs/           # 文档
├── deploy/              # 部署脚本(install.sh, deploy-bridge.sh, deploy-mcp.sh)
├── scripts/             # 迁移与测试脚本(migrate-to-clum.sh, migrate-bridge-to-clum.sh, mcp_smoke.py, mcp_remote_test.py)
└── SKILL.md             # clum-mcp 使用指南(skill 源文件,随代码维护)

Skill 安装位置:clum-mcp skill 源自本仓库根目录的 SKILL.md,安装到全局(~/.config/opencode/skills/clum-mcp/)。项目内不再保留 .opencode/skills/、.qoder/skills/ 副本;修改 skill 请直接改根 SKILL.md,再同步到全局安装目录。

常用命令

just check       # cargo check --workspace
just test        # cargo test --workspace
just fmt         # cargo fmt --all
just lint        # cargo clippy --workspace -- -D warnings
just build       # cargo build --workspace
just release-linux  # 交叉编译 Linux x86_64

Read the full file on GitHub · 55 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 13d ago Changed · +1 lines · +36 tokens per session 8b4c57c1ba65
  2. 1mo ago Changed · +1 lines · +116 tokens per session 2e2cda793889
  3. 1mo ago Changed · +17 tokens per session 75587da508cc
  4. 2mo ago First seen · 53 lines · 849 tokens per session scan A dd975e6c6a66

Subscribe to this mod's changes

clum AGENTS.md is an instructions file published in the GitHub repository tddh/clum (6 stars, last pushed 13d ago), licensed MIT. It adds 1,018 tokens to every session, about $0.0041 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

clum AGENTS.md compared with instructions from other repositories

clum AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
clum AGENTS.mdtddh/clumInstructions file613d agoMITA1,018Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143kyesterdayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode