Borrowing it
Nothing to install: this file belongs to jdkruzr/ForestNote. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jdkruzr/ForestNote/main/CLAUDE.mdgit clone --depth 1 https://github.com/jdkruzr/ForestNoteWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/jdkruzr/forestnote/claude-md)<a href="https://agentmods.dev/instructions/jdkruzr/forestnote/claude-md"><img src="https://agentmods.dev/badge/instructions/jdkruzr/forestnote/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/jdkruzr/forestnote/claude-md"><img src="https://agentmods.dev/badge/instructions/jdkruzr/forestnote/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02041 | $0.02041 |
| Opus 5.5 | $0.00816 | $0.00816 |
| Sonnet 5.5 | $0.00408 | $0.00408 |
| Haiku 4.5 | $0.00204 | $0.00204 |
Grade A, and why
ForestNote CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ForestNote
Last verified: 2026-08-23 (ForestNote 2.0 local-first + portable brushes)
E-ink note-taking app for low-latency stylus handwriting. Two firmware-latency ink paths sit behind one InkBackend seam: the Viwoods AiPaper Mini via reverse-engineered ENote callbacks (direct digitizer input on ENote's worker thread → app bitmap → partial panel refresh), and Boox/Onyx devices via the published Onyx Pen SDK (TouchHelper/RawInputCallback — firmware renders live ink). A generic View.invalidate() fallback covers any other Android device. Backend is auto-detected at launch; stored stroke DATA is identical across platforms (only the live on-panel transport differs).
Tech Stack
- Language: Kotlin (Android)
- Min SDK: 30, Target SDK: 30, Compile SDK: 35
- Build: Gradle with convention plugins in
build-logic/ - Storage: SQLDelight 2.0.2 (SQLite). The single library file (
default.forestnote) lives at/sdcard/ForestNote/(top-level shared external storage) so it survives an uninstall/reinstall (chiefly the debug→release signing-key swap) and is Termux-inspectable. Creating a top-level/sdcardfolder on API 30+ needsMANAGE_EXTERNAL_STORAGE("All files access"), whichMainActivityrequests on first launch; until granted, the datastore falls back to app-private storage and migrates out to/sdcardonce granted. Redirected viaStorageLocation/ExternalStorageContextincore:format— seecore/format/CLAUDE.md. Secrets (EncryptedSharedPreferences) stay in private storage. - Device↔server sync: the RhizomeSync library (
io.rhizome:rhizome-core/-sqlite/-http:0.8.2, published to mavenLocal from~/rhizome) — the schema-driven, row-level-LWW, HLC-stamped sync core extracted from FN+UB so the correctness-critical algorithm lives in one place.core:formatbinds it viaSqliteStorageAdapter+ForestNoteRegistry(wire v5, hashed367ffd…: exact page width/height + portable brush identity/version/seed/dynamics);app:notesdrives the engine. Sync is explicitly opt-in; a fresh install is a complete local-only app. - Geometry: Jetpack Ink API 1.0.0 (brush/geometry/strokes)
- Boox/Onyx ink: Onyx Pen SDK (
onyxsdk-pen:1.5.4+-device:1.3.5+-base:1.8.5) +hiddenapibypass:6.1, used only byBooxInkBackendincore:ink, runtime-gated to Onyx devices (inert elsewhere); cleartext-HTTP Maven repo. Seecore/ink/CLAUDE.mdfor the firmware raw-drawing model (two independent firmware switches, canvas-only surface, freeze-toggle reconcile) - UI: Android Views (no Compose), Material 3
- Handwriting recognition: Google ML Kit Digital Ink 18.1.0 (stroke-native; bundled-only artifact requires GMS + one-time per-language ~20 MB model download via
RemoteModelManager— host tablet has GMS + Google account) - CalDAV transport: OkHttp 4.12.0 (scoped to
app/notes/caldav/only — the device-sync engine ridesHttpURLConnectionvia RhizomeSync'sio.rhizome.http.HttpUrlTransport, dependency-light per the originalcore:syncrationale, now upstreamed into the library). UI never PUTs synchronously: the lasso → task path enqueues into a local SQLite outbox (caldav_outbox, LOCAL-ONLY) and aCalDavOutboxDrainer(lifecycle peer ofSyncController) does the PUTs, with aNetworkAvailabilityMonitorkickingdrainNow()when WiFi comes back. No WorkManager — the AiPaper is foreground-driven, and SQLite + lifecycle hooks +NetworkCallbackcover the actual failure mode - Secret storage:
androidx.security:security-crypto1.1.0-alpha06 (EncryptedSharedPreferences, AES-256 key in Android Keystore) — owns sync + CalDAV credentials;SettingsJSON blob is non-secrets only
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 61 lines · 2,041 tokens per session scan A 58e0336219a4
ForestNote CLAUDE.md is an instructions file published in the GitHub repository jdkruzr/ForestNote (14 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 2,041 tokens to every session, about $0.0082 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
ForestNote CLAUDE.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| ForestNote CLAUDE.mdjdkruzr/ForestNote | Instructions file | 14 | 1mo ago | Apache-2.0 | A | 2,041 | Claude Code |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | today | MIT | A | 7,461 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 5,685 | GitHub Copilot |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 3,093 | GitHub Copilot |
| vscode model-prompts.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 2,022 | GitHub Copilot |