tinycode CLAUDE.md

Development instructions for the tinycode project, including its Bun commands, terminal interface, web interface, desktop app, IDE integration, linting, type checking, and tests.

In plain words
What is it for?
Use them when developing tinycode, starting its different modes, checking code quality and types, or running package-level tests.
Why use it?
They clarify which commands install, run, and validate the project, and where those commands should be executed.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/bobbyjohnstx/tinycode/claude-md
Clone the repo
git clone --depth 1 https://github.com/bobbyjohnstx/tinycode
Per session 3,321 This file is loaded in full into every session.
When invoked 3,321 The same file — it is already loaded in full.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03321 $0.03321
Opus 5 $0.01661 $0.01661
Sonnet 5 $0.00664 $0.00664
Haiku 4.5 $0.00332 $0.00332

Measured yesterday against content hash fe813a1f90a5, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

tinycode CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

> **Note:** End users install tinycode via `curl -fsSL https://raw.githubusercontent.com/bobbyjohnstx/tinycode/main/install.sh | sh` or `npx tinycode-ai`. The `bun install` path below is for **development** only.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

> **Note:** End users install tinycode via `curl -fsSL https://raw.githubusercontent.com/bobbyjohnstx/tinycode/main/install.sh | sh` or `npx tinycode-ai`. The `bun install` path below is for **development** only.
CLAUDE.md · 166 lines

How it starts

The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Commands

Note: End users install tinycode via curl -fsSL https://raw.githubusercontent.com/bobbyjohnstx/tinycode/main/install.sh | sh or npx tinycode-ai. The bun install path below is for development only.

# Install dependencies (from repo root, development only)
bun install

# Run in development (TUI mode)
bun dev
bun dev <directory>     # run against a different directory
bun dev .               # run against repo root

# Other dev modes
bun dev serve           # headless API server (port 4096)
bun dev web             # server + open web interface
bun dev acp             # Agent Client Protocol mode (IDE integration, stdio transport)
bun run --cwd packages/app dev        # web UI only (requires server running)
bun run --cwd packages/desktop dev    # Electron desktop app

# Lint
bun run lint            # oxlint across all packages

# Type check (run from a package directory, not root)
bun typecheck           # from e.g. packages/tinycode

# Tests (run from a package directory, never from root)
bun test                # from e.g. packages/tinycode
bun test --timeout 30000 path/to/file.test.ts  # single test file

# Build standalone binary
./packages/tinycode/script/build.ts --single

# Regenerate SDK after API changes (server.ts changes → run this)
./script/generate.ts

# Export session to JSON or HTML
tinycode export --format json <session-id>       # JSON format (default)
tinycode export --format html <session-id>       # Self-contained HTML file

Tests cannot run from repo root (do-not-run-tests-from-root guard). Always cd into a package first.

Testing

Mock LLM Provider

For deterministic testing of session logic, use MockLanguageModel from test/fake/mock-language-model.ts. It accepts a sequence of scenarios that define responses for successive LLM calls:

import { MockLanguageModel, type MockScenario } from "@/test/fake/mock-language-model"

const scenarios: MockScenario[] = [
  { type: "text", content: "First response" },
  { type: "text", content: "Second response" },
  {
    type: "tool-call",
    calls: [{ id: "call-1", name: "tool-name", args: { key: "value" } }],
  },
  { type: "error", error: new Error("Simulated failure") },
]

const model = new MockLanguageModel(scenarios)

Read the full file on GitHub · 166 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 166 lines · 3,321 tokens per session scan C fe813a1f90a5

Subscribe to this mod's changes

tinycode CLAUDE.md is an instructions file published in the GitHub repository bobbyjohnstx/tinycode (11 stars, last pushed 4d ago), licensed MIT. It adds 3,321 tokens to every session, about $0.0166 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.