Borrowing it
Nothing to install: this file belongs to BuaaJoseph/claude-code-best-practice-zh. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/BuaaJoseph/claude-code-best-practice-zh/master/.claude/commands/workflows/best-practice/workflow-claude-settings.mdgit clone --depth 1 https://github.com/BuaaJoseph/claude-code-best-practice-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/buaajoseph/claude-code-best-practice-zh/workflow-claude-settings)<a href="https://agentmods.dev/commands/buaajoseph/claude-code-best-practice-zh/workflow-claude-settings"><img src="https://agentmods.dev/badge/commands/buaajoseph/claude-code-best-practice-zh/workflow-claude-settings.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.03950 |
| Opus 5 | $0.00008 | $0.01975 |
| Sonnet 5 | $0.00003 | $0.00790 |
| Haiku 4.5 | $0.00002 | $0.00395 |
Grade A, and why
workflow-claude-settings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to workflow-claude-settings — 235 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
工作流变更日志 — 设置报告
您是 claude-code-best-practice 项目的协调员。您的工作是并行启动两个研究 agent，等待它们的结果，合并发现，并呈现一份关于 设置参考报告（best-practice/claude-settings.md）漂移的统一报告。
要检查的版本： $ARGUMENTS（如果为空或不是数字，默认为 10）
这是一个先读取后报告的工作流。启动 agent，合并结果，产生报告。只有在用户批准后才采取行动。
阶段 0：并行启动两个 Agent
立即使用 Task 工具在同一条消息中并行启动两个 agent：
Agent 1：workflow-claude-settings-agent
使用 subagent_type: "workflow-claude-settings-agent" 生成。给它这个提示：
研究 claude-code-best-practice 项目的设置报告漂移。检查最近 $ARGUMENTS 个版本（默认：10）。
获取这 3 个外部来源：
- 设置文档：https://code.claude.com/docs/en/settings
- CLI 参考：https://code.claude.com/docs/en/cli-reference
- 变更日志：https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
然后读取本地报告文件（
best-practice/claude-settings.md）和 CLAUDE.md 文件。分析官方文档关于设置键、权限语法、钩子事件、MCP 配置、沙箱选项、插件设置、模型别名、显示设置和环境变量与我们报告记录的内容之间的差异。返回涵盖缺失设置、变更类型/默认值、新设置添加、弃用设置、权限语法变更、钩子事件变更、MCP 设置变更、沙箱设置变更、环境变量完整性、示例准确性、设置层次结构准确性和源有效性的结构化发现报告。
Agent 2：claude-code-guide
使用 subagent_type: "claude-code-guide" 生成。给它这个提示：
研究最新的 Claude Code 设置系统。我需要您找到：
- 当前所有支持的 settings.json 键的完整列表及其类型、默认值和描述
- 近期 Claude Code 版本中引入的任何新设置键
- 现有设置行为的变更（例如新的权限模式、新的钩子事件、新的沙箱选项）
- 设置层次的变更（新的优先级级别、新的文件位置）
- 权限语法的变更（新的工具模式、新的通配符行为）
- 新的钩子事件或钩子配置结构的变更
- MCP 服务器配置的变更（新的匹配字段、新的设置）
- 沙箱设置的变更（新的网络选项、新的命令）
- 插件配置的变更（新的字段、新的市场选项）
- 环境变量的变更（新的变量、弃用的变量、变更的行为）
- 模型别名或模型配置的变更
- 显示/用户体验设置的变更（状态行、微调器、进度条）
- 任何设置键的弃用或移除
要彻底 — 搜索网络，获取文档，并为您找到的每件事提供具体的版本号和详细信息。
两个 agent 独立运行并返回它们的发现。
阶段 0.5：读取验证清单
在 agent 运行期间，读取 changelog/best-practice/claude-settings/verification-checklist.md。此文件包含累积的验证规则 — 每条规则指定检查什么、到什么深度、以及与哪个源比较。在阶段 2 期间必须执行每条规则。清单是项目用于漂移检测的回归测试套件。
阶段 1：读取之前的变更日志条目
在合并发现之前，读取文件 changelog/best-practice/claude-settings/changelog.md 以获取最后 25 个变更日志条目。每个条目由 --- 分隔。解析这些先前条目中的优先级操作，以便您可以将它们与当前发现进行比较。这让您能够识别：
- 重复出现的问题 — 之前出现过但仍未解决的问题
- 新解决的问题 — 之前运行中出现但现在已修复的问题
- 新问题 — 首次在此运行中出现的问题
阶段 2：合并发现并生成报告
等待两个 agent 完成。 获得以下内容后：
- workflow-claude-settings-agent 发现 — 带有本地文件读取、外部文档获取和漂移检测的详细报告分析
- claude-code-guide 发现 — 关于最新 Claude Code 设置功能和变更的独立研究
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 243 lines · 15 tokens per session scan A 667bfe089602
workflow-claude-settings is a command published in the GitHub repository BuaaJoseph/claude-code-best-practice-zh (2 stars, last pushed 4mo ago), licensed MIT. It adds 15 tokens to every session and 3,950 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 86% identical to workflow-claude-settings, differing in 235 lines, and is treated as a copy.
Other commands, from other repositories
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.
converge
Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.
implement
Execute the implementation plan by processing and executing all tasks defined in tasks.md.
analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.