Home / iohub / yagent · GitHub

AGENTS.md@internal/toolsA

AGENTS.md@internal/tools from iohub/yagent is an AGENTS.md file: the standing instructions coding agents read in that repo.

Install it, pinned

mdr add iohub/yagent/internal/tools/AGENTS.md@git:20261028.781f193

Pins git:20261028.781f193 in mdr.lock. Pin the fingerprint instead.

Audit grade: A, 14 of 14 checks passed
Kind: AGENTS.md file
Repository: iohub/yagent
Path: internal/tools/AGENTS.md
Versions recorded: 8
Latest version: git:20261028.781f193, committed Oct 28, 2026
First version recorded: Oct 21, 2026
Size: 15,342 bytes
Repository stars: 31
License: Apache-2.0

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# internal/tools — 工具执行层与工作区守卫

> 范围：本目录内不可派生的约束。全局见仓库根 `AGENTS.md` §5。
> "谁能用什么"不在这里（画像在 `internal/toolspec`）；LLM-工具循环在 `agents/executor.go`。

## 边界

把注册表里的 Spec 装配成一次运行的工具面（`Surface`），并提供文件/Shell/检索/调用图/浏览器/
认知类工具的执行器，加上工作区守卫与授权回路。`internal/diff`（16 行）只是 `search_replace_in_file`
的回显装饰：内容相同返回空串（`internal/diff/diff.go:10-12`），三个调用点都只当展示文本、不判错，
所以"空串"不会被误读成失败——10MB/50KB 那些限制不在它那儿。

## 硬约束

**1. `Surface` 是唯一工具来源。** `NewSurfaceFromAdapters`（`surface.go:75-99`）存在的理由是
**不让测试自带第二个载体**——历史上并发谓词扫 `Adapters`、测试也填 `Adapters`，于是八条用例全绿
而生产一次都没并行（根 AGENTS.md §11 坑 33）。不要再给 `ExecutorConfig` 塞快照。
`scripts/check_no_manual_lookup.sh:19-31` 的 FORBIDDEN 十条（按名字查工具的旧符号与名字表）必须为零，
PENDING 名单已清空（`:34-37`），往 `internal/agents` 里重新写按工具名 `case` 分派直接红。

**2. 授权判据来自注册表，分派按 Effect 不按名字**（`workspace_guard.go:Check`）。
guard 由 `rebuild` 统一挂（`surface.go:122-125`），集中构造消除了"某个 appender 忘记 SetGuard"。

**3. 工作区目录本身算越界。** `isInWorkspace` 对 `rel == "."` 返回 false
（`workspace_guard.go:isInWorkspace`）。`run_bash` **没有黑名单**：纵深防御 = 信任 LLM 的 `is_dangerous`
+ 任何指向工作区外的绝对路径 token 都要授权，`safeSystemPaths` 白名单只此一处且根目录恒危险
（`workspace_guard.go:checkBash,referencesOutsideWorkspace`）。
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint

mdr add iohub/yagent/internal/tools/AGENTS.md@sha256:bdb7b505405f7358

The line at the top of this page pins the label git:20261028.781f193, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

[![mdr](https://markdownregistry.com/badge/art_4t3d3clkhqnmr4qj.svg)](https://markdownregistry.com/a/art_4t3d3clkhqnmr4qj)

2 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 8 versions of this file, between Oct 21, 2026 and Oct 28, 2026, more than one a day.

version	committed	commit	size	audit
git:20261028.781f193 latest	2026-10-28	781f193	15,342 B	A	view · diff
git:20261028.0fb9ff9	2026-10-28	0fb9ff9	15,136 B	A	view · diff
git:20261028.5946dc5	2026-10-28	5946dc5	15,132 B	A	view · diff
git:20261027.0637c8b	2026-10-27	0637c8b	14,856 B	A	view · diff
git:20261026.e51eca4	2026-10-26	e51eca4	14,298 B	A	view · diff
git:20261024.9b44441	2026-10-24	9b44441	8,288 B	A	view · diff
git:20261023.34d2295	2026-10-23	34d2295	4,792 B	A	view · diff
git:20261021.9f5bf87	2026-10-21	9f5bf87	4,167 B	A	view

Audit of the latest version

A 14 of 14 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.

pass: Size between 200 bytes and 200 KB (15342 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag

Source

GitHub

iohub/yagent · 31 stars · license Apache-2.0 · pushed 2026-11-05 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_4t3d3clkhqnmr4qj
GET https://markdownregistry.com/api/v1/resolve?ref=iohub/yagent/internal/tools/AGENTS.md
GET https://markdownregistry.com/api/v1/blob/bdb7b505405f7358221df5e4ed6ab71c8d90399e45c7b2c771568fe304256c32

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: how to write a good AGENTS.md · AGENTS.md vs CLAUDE.md · which agent file does what.