clave CLAUDE.md

Project instructions for Clave, a Mac desktop app that runs multiple coding-agent command-line sessions, terminals, and remote agents side by side.

In plain words
What is it for?
Use them when developing Clave, including running its checks, building macOS packages, updating its companion plugin, and handling signing or notarization.
Why use it?
They give an agent the commands, architecture, conventions, and release requirements needed to work consistently in the project.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/codika-io/clave/claude-md
Clone the repo
git clone --depth 1 https://github.com/codika-io/clave
Per session 3,625 This file is loaded in full into every session.
When invoked 3,625 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03625 $0.03625
Opus 5 $0.01813 $0.01813
Sonnet 5 $0.00725 $0.00725
Haiku 4.5 $0.00363 $0.00363

Measured 2d ago against content hash 4178c4411f53, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

clave CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

- **PATH resolution in packaged app (CRITICAL)**: Packaged Electron apps have a minimal PATH (`/usr/bin:/bin:/usr/sbin:/sbin`). The user's full PATH must be resolved by spawning a login shell. **NEVER use `execSync`** —
CLAUDE.md · 90 lines

How it starts

The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Clave

Mac desktop app for managing multiple coding-agent CLI sessions in parallel. Provider-agnostic: it orchestrates Claude Code (Cmd+N), Antigravity CLI (Cmd+I), and Codex CLI (Cmd+U) sessions side by side, plus plain terminals (Cmd+T) and remote agents over OpenClaw. Electron + React + TypeScript.

Clave's companion agent plugin (clave, exposing /clave:create-workspace and /clave:recover-sessions) ships from plugin/ in this repo — see plugin/CLAUDE.md. It is installed with npx plugins add codika-io/clave, resolved through .claude-plugin/marketplace.json at the root. The Electron app reads installed plugins from ~/.claude/plugins/ at runtime and never reads plugin/ directly; the folder is here so a .clave format change and the skill that describes it land in the same commit (see the schema sync rule below).

Commands

  • npm run dev — start dev (Electron window + hot reload)
  • npm run build — typecheck + build
  • npm run build:mac — build + package macOS universal dmg + zip (signed + notarized)
  • npm run typecheck — typecheck only
  • npm run lint — eslint
  • Releases ship via CI on push to prod (bump from a [minor]/[major] commit-message marker, else patch) — see .claude/rules/release.md. npm run release -- --patch|--minor|--major remains the local fallback.

Architecture

Three-process Electron app:

  • Main (src/main/): Electron window, node-pty, IPC handlers, domain managers. PTY spawns /bin/zsh -l -c claude per session. IPC handlers are split into modular files under ipc-handlers/.
  • Preload (src/preload/): Typed window.electronAPI via contextBridge. All main↔renderer communication goes through IPC.
  • Renderer (src/renderer/src/): React + Zustand + xterm.js + Tailwind v4 + Framer Motion.

Windows (PRDCT-1703): a window is the whole app once more, on whatever workspace the user put it on — several windows may show the same workspace. One main process, one MCP server, one pty-manager, one event store; each window is a renderer with its own Zustand stores. Sessions and groups live in the window they were opened in, and that is all "which window" means: every window has a persisted windowKey (windows.json, src/main/window-state.ts), its own sidebar layout file (sidebar-layouts/windows/<key>.json), and session records carry the key of their home window. The runtime truth (window ↔ key ↔ workspace, session → window) is src/main/window-registry.ts; the lowest-id live window is the primary: it adopts orphans at boot (records and layouts whose window no longer exists) and takes in what a closing window leaves (its tmux-backed tabs re-home there with their groups, ids preserved). Moving a tab or a group between windows is the same detach + re-adopt (window:move-sessions / window:move-group), and the agent tools take a window argument for it. A call from an agent lands in the window holding its subject session, else the window it names, else the caller's window — never a window picked from the workspace argument.

Read the full file on GitHub · 90 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 90 lines · 3,625 tokens per session scan A 4178c4411f53

Subscribe to this mod's changes

clave CLAUDE.md is an instructions file published in the GitHub repository codika-io/clave (47 stars, last pushed 4d ago), licensed MIT. It adds 3,625 tokens to every session, about $0.0181 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.