What is headroom AGENTS.md?

Project instructions for Headroom, a browser extension built with WXT, a framework for web extensions. They describe its Manifest V3 setup, supported browsers, commands, architecture, and cloud storage using Upstash Redis.

Use them when developing, building, or debugging Headroom for Chrome, Edge, or Firefox, and when working with its browser-extension settings or Redis-backed storage.

They prevent agents from editing the wrong instruction file or using the wrong development and production output directories. They also document the project's structure and data model.

How ZM-BAD/headroom configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to ZM-BAD/headroom. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/ZM-BAD/headroom/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/ZM-BAD/headroom

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/zm-bad/headroom/agents-md/github.svg)](https://agentmods.dev/instructions/zm-bad/headroom/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/zm-bad/headroom/agents-md"><img src="https://agentmods.dev/badge/instructions/zm-bad/headroom/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/zm-bad/headroom/agents-md"><img src="https://agentmods.dev/badge/instructions/zm-bad/headroom/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 6,641 This file is loaded in full into every session.

When invoked 6,641 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.06641	$0.06641
Opus 5.5	$0.02656	$0.02656
Sonnet 5.5	$0.01328	$0.01328
Haiku 4.5	$0.00664	$0.00664

Measured 17d ago against content hash 8386c4093435, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

headroom AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 235 lines

How it starts

The opening of the file, as written. The whole thing — 235 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Project instructions for AI coding agents (Claude Code, Cursor, Copilot, Windsurf, etc.) working in this repository.

Single source of truth — edit AGENTS.md, not CLAUDE.md. CLAUDE.md is a symlink to this file (AGENTS.md). This is deliberate: AGENTS.md is the cross-agent standard filename (Cursor / Copilot / Windsurf read it), while Claude Code reads CLAUDE.md — the symlink serves both from one source. Most editors and tools (including the Edit tool) reject writing through a symlink ("Refusing to write through symlink"), so always open and edit AGENTS.md directly. Do not replace the symlink with a real file, delete it, or duplicate the content into CLAUDE.md.

Project Overview

Headroom is a browser extension built with WXT (next-gen web extension framework). Manifest V3 only — Chrome, Edge, and Firefox. MV2 is not supported (manifestVersion: 3 is set in wxt.config.ts, overriding WXT's Firefox-default MV2).

Commands

npm run dev              # Dev + HMR → .output/chrome-mv3-dev/ (DIFFERENT dir from build!)
npm run dev:firefox      # Dev mode for Firefox
npm run build            # Production build → .output/chrome-mv3/
npm run build:chrome     # Same as build (alias)
npm run build:firefox    # Production build → .output/firefox-mv3/
npm run build:edge       # Production build → .output/edge-mv3/
npm run zip              # Package .zip for distribution (Chrome)
npm run zip:firefox      # Package .zip for Firefox
npm run zip:edge         # Package .zip for Edge
npm run lint             # ESLint check
npm run lint:fix         # ESLint auto-fix
npm run typecheck        # TypeScript type check (tsc --noEmit)
npm test                 # Run tests in watch mode
npm run test:run         # Run tests once
npm run test:coverage    # Tests + coverage (used by `npm run check`)
npm run format:check     # Prettier check
npm run check:quality    # lint + format + i18n + permissions + typecheck
npm run check:test       # Tests with coverage
npm run check:build      # Chrome + Firefox + Edge production builds
npm run check            # Shared CI + pre-commit gate (quality + test + all builds)
npm run check:secrets       # gitleaks full git history (CI)
npm run check:secrets:staged # gitleaks staged diff (pre-commit)
npm run audit            # npm audit against the official registry
npx wxt prepare          # Regenerate types in .wxt/ (auto-runs on postinstall)

Read the full file on GitHub · 235 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

17d ago Changed · +11 lines · +149 tokens per session 8386c4093435
2mo ago First seen · 224 lines · 6,492 tokens per session scan A c964338a006e

Subscribe to this mod's changes

headroom AGENTS.md is an instructions file published in the GitHub repository ZM-BAD/headroom (46 stars, last pushed yesterday), licensed Apache-2.0. It adds 6,641 tokens to every session, about $0.0266 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

chatbot context-window token-usage wxt-extension

headroom AGENTS.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
headroom AGENTS.mdZM-BAD/headroom	Instructions file	46	yesterday	Apache-2.0	A	6,641	Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	today	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

headroom: Instructions file for Codex