svelte-vibe-code CLAUDE.md

Repository instructions for a SvelteKit application that uses Svelte, Convex as its real-time database, and Playwright for browser tests.

In plain words
What is it for?
Use them to install dependencies, run the Convex backend and development server, execute tests, and run formatting, linting, and type checks.
Why use it?
They give coding agents the commands, workflow, project structure, and backend requirements needed to work on the repository correctly.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/fmaclen/svelte-vibe-code/claude-md
Clone the repo
git clone --depth 1 https://github.com/fmaclen/svelte-vibe-code
Per session 809 This file is loaded in full into every session.
When invoked 809 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00809 $0.00809
Opus 5 $0.00404 $0.00404
Sonnet 5 $0.00162 $0.00162
Haiku 4.5 $0.00081 $0.00081

Measured 2d ago against content hash b503cf65b7c9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

svelte-vibe-code CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 103 lines

How it starts

The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Common Development Commands

Development Workflow

# Install dependencies
npm install

# Start Convex backend (keep running in terminal 1)
npm run convex

# Run development server (terminal 2)
npm run dev

# Run tests (requires Convex running)
npm test

# Quality checks
npm run quality    # Runs format, lint, and type checks
npm run format     # Auto-format code with Prettier
npm run lint       # Check code style with ESLint and Prettier
npm run check      # Type check with svelte-check

Testing

# Run E2E tests with Playwright (Convex must be running)
npm test

# Tests will automatically set IS_DEV_OR_TEST=true for database clearing

Architecture Overview

Stack

  • Frontend: SvelteKit (client-only, no SSR) + Svelte 5 with runes
  • UI Components: shadcn-svelte 1.x (Tailwind v4 + Bits UI) - fully installed in src/lib/components/ui/
  • Backend: Convex (real-time database with TypeScript functions)
  • Auth: Custom implementation using Convex sessions (demo-ready, not production-ready)
  • Testing: Playwright E2E tests

Key Directories

  • convex/ - Backend functions and database schema
    • schema.ts - Database tables: users, sessions, messages
    • auth.ts - Authentication mutations/queries (signUp, signIn, signInAnonymously, signOut, currentUser)
    • messages.ts - Real-time messaging functions
    • dev.ts - Development helpers (clearAllData - only works with IS_DEV_OR_TEST=true)
  • src/lib/auth.svelte.ts - Client-side auth state management using Svelte 5 runes
  • src/lib/components/ui/ - Complete shadcn-svelte component library
  • src/routes/ - SvelteKit pages

Important Patterns

Authentication Flow
  1. Auth state is managed in src/lib/auth.svelte.ts using Svelte 5 runes ($state, $derived, $effect)
  2. Auth context is set up in src/routes/+layout.svelte
  3. Pages use AuthGuard component for protection
  4. Sessions stored in localStorage with token-based authentication
  5. Passwords are hashed client-side with PBKDF2, then server-side with bcrypt

Read the full file on GitHub · 103 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 103 lines · 809 tokens per session scan A b503cf65b7c9

Subscribe to this mod's changes

svelte-vibe-code CLAUDE.md is an instructions file published in the GitHub repository fmaclen/svelte-vibe-code (3 stars, last pushed 1y ago), licensed MIT. It adds 809 tokens to every session, about $0.0040 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.