What is QLExpress CLAUDE.md?

Repository instructions for QLExpress, Alibaba’s Java engine for running dynamic expressions and business rules. They explain how scripts are parsed, compiled, and executed, along with the main components and testing rules.

Use them when changing the script compiler, virtual machine, functions, operators, data conversion, execution context, security controls, or related tests.

They help an agent work within the engine’s existing execution model instead of changing one part while breaking parsing, runtime behavior, or type conversion elsewhere.

How alibaba/QLExpress configures Claude Code

About the project

QLExpress is a lightweight dynamic programming language that runs on the Java platform. It is intended for developers who need to add programmable behavior to different business applications.

alibaba/QLExpress · 5,644 stars · on GitHub

Reuse

Borrowing it

Nothing to install: this file belongs to alibaba/QLExpress. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/alibaba/QLExpress/main/CLAUDE.md

Clone the repo

git clone --depth 1 https://github.com/alibaba/QLExpress

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/alibaba/qlexpress/claude-md/github.svg)](https://agentmods.dev/instructions/alibaba/qlexpress/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/alibaba/qlexpress/claude-md"><img src="https://agentmods.dev/badge/instructions/alibaba/qlexpress/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/alibaba/qlexpress/claude-md"><img src="https://agentmods.dev/badge/instructions/alibaba/qlexpress/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 2,320 This file is loaded in full into every session.

When invoked 2,320 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.02320	$0.02320
Opus 5.5	$0.00928	$0.00928
Sonnet 5.5	$0.00464	$0.00464
Haiku 4.5	$0.00232	$0.00232

Measured 2mo ago against content hash 0f9bd8b6e4f1, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

QLExpress CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 224 lines

How it starts

The opening of the file, as written. The whole thing — 224 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QLExpress 项目架构与开发测试规范

项目架构

1. 项目概述

QLExpress 是阿里巴巴开源的一个轻量级、高性能的动态语言引擎，基于 Java 8+ 开发，专为业务规则引擎和动态表达式设计。

2. 核心组件和职责

2.1 主要工作流程

用户代码
  ↓
Express4Runner (入口点)
  ├─→ [编译阶段]
  │   ├─ SyntaxTreeFactory: 构建 ANTLR 语法树
  │   ├─ QvmInstructionVisitor: 遍历语法树生成指令
  │   └─ QCompileCache: 缓存编译结果
  │
  ├─→ [运行阶段]
  │   ├─ QvmRuntime: 虚拟机运行时环境
  │   ├─ QLambdaInner: Lambda 执行体
  │   ├─ FixedSizeStack: 操作数栈
  │   └─ 指令执行引擎
  │
  └─→ [结果阶段]
      ├─ Value: 返回值包装
      └─ QLResult: 结果 + 执行追踪

2.2 核心组件详解

组件	位置	职责	关键类
入口点	顶层	统一脚本执行入口	`Express4Runner`
编译器	`aparser/`	词法→语法→指令生成	`SyntaxTreeFactory`, `QvmInstructionVisitor`
运行时	`runtime/`	JVM 栈式虚拟机执行	`QvmRuntime`, `QLambdaInner`, `FixedSizeStack`
函数体系	`runtime/function/`	内置和自定义函数	`CustomFunction`, `QMethodFunction`
运算符体系	`runtime/operator/`	内置和自定义运算符	`BinaryOperator`, `OperatorManager`
指令集	`runtime/instruction/`	虚拟机指令集 (~40+ 种)	`QLInstruction` 子类
数据体系	`runtime/data/`	值类型和类型转换	`Value`, `DataValue`, `ObjTypeConvertor`
上下文	`runtime/context/`	脚本执行环境	`ExpressContext`, 多种实现
安全策略	`security/`	反射安全隔离	`QLSecurityStrategy`, 4 种策略
执行追踪	`runtime/trace/`	表达式执行路径记录	`ExpressionTrace`, `TracePointTree`

3. 主要的包和类的组织方式

3.1 分层结构

表现层 (API):
  └─ Express4Runner, QLResult, QLOptions, InitOptions

编译层 (Parsing & Code Generation):
  ├─ 词法分析: QLexer, QLExtendLexer
  ├─ 语法解析: QLParser, QLExtendParser
  ├─ 语法树: QLParser.ProgramContext (ANTLR生成)
  ├─ 代码生成: QvmInstructionVisitor
  ├─ 缓存: QCompileCache, FutureTask<QCompileCache>
  └─ 工具: SyntaxTreeFactory, ImportManager

运行层 (Execution):
  ├─ 虚拟机: QvmRuntime, QLambdaInner, FixedSizeStack
  ├─ 上下文: ExpressContext 实现类
  ├─ 作用域: QvmGlobalScope, GeneratorScope
  ├─ 功能: CustomFunction, QMethodFunction
  ├─ 运算符: BinaryOperator, OperatorManager
  ├─ 指令: QLInstruction 子类 (~40个)
  └─ 数据: Value, DataValue, 类型转换

支撑层 (Infrastructure):
  ├─ 安全: QLSecurityStrategy, 4种策略
  ├─ 反射: ReflectLoader, MemberResolver
  ├─ 异常: QLException, 错误处理
  ├─ 追踪: ExpressionTrace, TracePointTree
  └─ 工具: BasicUtil, QLFunctionUtil

Read the full file on GitHub · 224 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 224 lines · 2,320 tokens per session scan A 0f9bd8b6e4f1

Subscribe to this mod's changes

QLExpress CLAUDE.md is an instructions file published in the GitHub repository alibaba/QLExpress (5,644 stars, last pushed 19d ago), licensed Apache-2.0. It adds 2,320 tokens to every session, about $0.0093 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

QLExpress CLAUDE.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
QLExpress CLAUDE.mdalibaba/QLExpress	Instructions file	5.6k	19d ago	Apache-2.0	A	2,320	Claude Code
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	today	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

QLExpress: Instructions file for Claude Code