botmux CLAUDE.md

Development instructions for botmux, a service that connects Feishu topic groups to AI coding command-line tools. Each new topic can start its own tool process.

In plain words
What is it for?
Use it when building or restarting botmux, installing dependencies, working on its daemon or dashboard, or changing native terminal and Electron-related dependencies.
Why use it?
It documents the Bun-based build and restart workflow and important dependency settings, reducing the risk of broken terminal processes or compiled binaries.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/deepcoldy/botmux/claude-md
Clone the repo
git clone --depth 1 https://github.com/deepcoldy/botmux
Per session 4,000 This file is loaded in full into every session.
When invoked 4,000 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.04000 $0.04000
Opus 5 $0.02000 $0.02000
Sonnet 5 $0.00800 $0.00800
Haiku 4.5 $0.00400 $0.00400

Measured 3d ago against content hash e96e2572ac38, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

botmux CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 138 lines

How it starts

The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.

botmux

飞书话题群 ↔ AI 编程 CLI 桥接。Daemon 监听飞书消息,每个新话题自动 spawn 一个独立 CLI 进程(Claude Code / Codex / Gemini 等 20+ 种,完整列表见 README)。

构建 & 运行

bun run build                # tsc 编译
bun run daemon:restart       # 重启 daemon(自动恢复 active sessions)
bun run daemon:logs          # 查看日志
  • 每次修改后需要 bun run build 然后 bun run daemon:restart

包管理器是 bunpackageManager: [email protected],锁文件 bun.lock)。装依赖用 bun install --frozen-lockfile

⚠️ trustedDependencies: ["electron","node-pty"] 不能删:bun 默认不跑依赖的生命周期脚本,而 node-pty 要靠它 node-gyp 编出 build/Release/pty.node —— 少了这个,PTY 全废、编译版二进制也打不出来(pty.node 是被嵌进去的)。electron 的 postinstall 负责下载对应平台的二进制。

这个名单刻意只有两项(与 pnpm 时代的 onlyBuiltDependencies 逐字一致),别照着"顺手补全"往里加 esbuild —— 实测 esbuild 虽然有 postinstall,但它的二进制由 @esbuild/<platform> 平台包直接提供:空白目录里 bun install esbuild 不跑任何脚本,esbuild --version 照样输出 0.28.2。加进白名单只会让 bun 比 pnpm 多跑脚本、扩大两者的行为差异,与迁移目标相反。

注意与「用户怎么装 botmux」区分开:install-diagnostics.tsInstallKind(含 'pnpm-global')与 maintenance.ts 的自动更新说的是终端用户的安装方式,线上确实有人 pnpm i -g botmux。那些不是本仓库的构建工具链,不要跟着一起改。

Bun 开发链路

daemon / supervisor / dashboard 都能直接跑 TypeScript,不必先 bun run build

bun run daemon:bun           # bun src/index-daemon.ts
bun run supervisor:bun       # bun src/index-supervisor.ts
bun run dashboard:bun        # bun src/index-dashboard.ts
bun run build:bun            # 打自包含单文件二进制(scripts/build-bun-binary.mjs)

发版编译用的 Bun 版本钉在 1.4.0(见 .github/workflows/)。本地 bun 与它差太多时,编译产物的行为可能和 CI 不一致——排查编译态问题前先核对 bun --version

测试里 spawn 子进程必须走 test/helpers/ts-runner.ts,不要写 spawn(process.execPath, ['--import','tsx', …]):那是 Node-only 形态,Bun 下 process.execPath 是 bun 二进制、bun --import tsx 不合法,子进程会全部起不来。helper 按运行时解析(Node 加 tsx loader、Bun 原生跑 TS)。片段里 import 仓库模块(.js specifier 实际是 .ts)时用 spawnTsEvalWithRepoImports,普通 spawnTsEval 在 Node 下会 ERR_MODULE_NOT_FOUND。

worktree 里也能直接用 bun,且不额外占依赖体积——只要不跑 install(见下节)。实测在「源码 + node_modules symlink 到 canonical」的 worktree 里,bun src/cli.tsbun run buildtscvitestbuild:bunpty.node 经 symlink 解析,不复制)以及编出二进制跑 smoke 六项,全部正常。

Read the full file on GitHub · 138 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 138 lines · 4,000 tokens per session scan A e96e2572ac38

Subscribe to this mod's changes

botmux CLAUDE.md is an instructions file published in the GitHub repository deepcoldy/botmux (1,264 stars, last pushed 3d ago), licensed MIT. It adds 4,000 tokens to every session, about $0.0200 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.