Reuse
Borrowing it
Nothing to install: this file belongs to jezweb/vite-flare-starter. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jezweb/vite-flare-starter/main/CLAUDE.mdgit clone --depth 1 https://github.com/jezweb/vite-flare-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/jezweb/vite-flare-starter/claude-md)<a href="https://agentmods.dev/instructions/jezweb/vite-flare-starter/claude-md"><img src="https://agentmods.dev/badge/instructions/jezweb/vite-flare-starter/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/jezweb/vite-flare-starter/claude-md"><img src="https://agentmods.dev/badge/instructions/jezweb/vite-flare-starter/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a> Per session 14,463 This file is loaded in full into every session.
When invoked 14,463 The same file — it is already loaded in full.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.14463 | $0.14463 |
| Opus 5 | $0.07232 | $0.07232 |
| Sonnet 5 | $0.02893 | $0.02893 |
| Haiku 4.5 | $0.01446 | $0.01446 |
Security
Grade C, and why
vite-flare-starter CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
security patches. A `git clone` + `rm -rf .git` cuts you off forever — Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST $URL/api/test-auth/cookies \ CLAUDE.md · 826 lines
How it starts
The opening of the file, as written. The whole thing — 826 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md — AI Developer Context
Project: Vite Flare Starter Version: 2.1.0 Purpose: Pattern library and production-ready starter kit for Cloudflare Workers
Philosophy: Pattern Library, Not a Demo
The modules in this starter are reference implementations. When an AI agent or developer builds a new feature in a fork, they should read the closest existing module first to learn the patterns for this stack.
Don't delete modules you don't need. Disable them via feature flags instead — the code stays readable as a pattern reference.
# In .dev.vars — hide modules from the sidebar without deleting code
VITE_FEATURE_CHAT=false
VITE_FEATURE_FILES=false
VITE_FEATURE_ACTIVITY=false
What each module demonstrates
| Module | Teaches | Key files |
|---|---|---|
| chat | ChatAgent extends AIChatAgent — DO-backed chat per (user, conv) pair. WebSocket transport, SQLite persistence, durable-stream recovery (chatRecovery + stall watchdog), MCP, Tool Search, skills, memory, projects, telemetry, D1 projection for cross-module reads |
server/modules/chat/chat-agent.ts, server/modules/chat/routes.ts (utility endpoints only) |
| conversations | Conversation persistence, ChatStorage interface (D1-backed, DO-ready) | server/modules/conversations/storage.ts |
| files | R2 upload/download, multipart form handling, metadata in D1 | server/modules/files/routes.ts |
| activity | Audit logging with pagination, entity history, stats aggregation | server/modules/activity/routes.ts |
| notifications | In-app service, unread counts, bulk operations | server/modules/notifications/routes.ts |
| updates | User-facing release notes ("What's New") — idempotent posts on releaseKey from the deploy path (pnpm changelog:post), quiet nav dot, and one dismissible banner for highlight entries only. Seen-state in user_meta, so it clears across devices. Nav item hides itself until the first entry is published. NOT CHANGELOG.md — that one is for fork maintainers, this one is for users |
server/modules/updates/routes.ts, client/modules/updates/README.md |
| api-tokens | Token generation, SHA-256 hashing, scope-based access | server/modules/api-tokens/routes.ts |
| feature-flags | DB-backed runtime feature toggles, public/admin endpoints — a pattern to copy for your product's own flags. Deliberately separate from the build-time VITE_FEATURE_* module-visibility flags (shared/config/features.ts), which are the only layer the starter gates on. |
server/modules/feature-flags/routes.ts |
| organization | Single-row business settings with upsert | server/modules/organization/routes.ts |
| admin | User management, role promotion, admin stats | server/modules/admin/routes.ts |
| settings | Profile CRUD, password, preferences, sessions, data export | server/modules/settings/routes.ts |
| skills | Claude Agent Skills registry + editor + AI-sparkle rewrite + diff approval | server/modules/skills/routes.ts |
| config-diff | Shared primitive for staged user-config changes (skills, prompts, …) | server/modules/config-diff/ |
| scheduled-agents | DO scheduled work via agents SDK schedule() / retry() — no hand-rolled alarms |
server/modules/scheduled-agents/reminder-agent.ts |
| autonomous-agents | Stateful AI agent base — persona + memory blocks + tools + decision loop (fiber-checkpointed: evictions detected + audit rows finalised via onFiberRecovered) + approval queue + webhooks + budget gate + run audit. Multi-agent handoff on native runAgentTool — awaited or detached facet children with durable onFinish; the AgentToolChildAdapter is implemented once on the base so ANY autonomous agent is dispatchable (#113 step 5) |
server/lib/agents/autonomous-agent.ts, server/modules/autonomous-agents/{assistant,researcher,writer}-agent.ts |
| mcp-agents | Agent-as-MCP-server pattern — exposes app data over MCP for external Claude Code / clients | server/modules/mcp-agents/scratchpad-mcp-agent.ts |
| approvals | Human-in-the-loop queue for autonomous agent actions — draft → review → approve → execute | server/modules/approvals/routes.ts |
| webhook-agents | External event ingestion — HMAC-verified webhook → agent.handleWebhook | server/lib/agents/webhook-verify.ts, server/modules/webhook-agents/routes.ts |
| agent-observability | agent_runs audit table + endpoints (cost / runs / errors per agent) |
server/modules/agent-observability/routes.ts |
| entities | Generic typed entity store + CRUD for CRM / Atlassian-style apps + agent tools | server/modules/entities/, server/modules/chat/tools/entities.ts |
| agent-memory | Vectorize-backed semantic recall (opt-in via AGENT_MEMORY binding) |
server/lib/agents/agent-memory.ts |
| field-configs | User-definable field schemas over entities.fields (#62) — field_configs CRUD (tenancy-aware), <DynamicFieldRenderer> renders any type's form with zero per-type code, buildFieldsSchema() gives opt-in zod validation. Worked example: kanban-demo card edit sheet. |
server/modules/field-configs/, client/components/DynamicFieldRenderer.tsx, client/hooks/useFieldConfigs.ts |
| share-tokens | Public read-only links to any record (#62) — hashed tokens (raw shown once), per-type resolver registry allow-lists the public payload, uniform 404 for unknown/revoked/expired, /share/:token page + <ShareButton>. Creator-scoped management even in shared tenancy. |
server/modules/share-tokens/, client/pages/SharePage.tsx, client/components/ShareButton.tsx |
| time-entries | Polymorphic time tracking (#62) — comments-style (entityType, entityId) attach, gated by the canAccessEntity oracle; entries author-deletable only in every tenancy mode. <TimeLogger> = persistent start/stop timer (localStorage) + manual log + billable flag + totals; /mine for timesheets. |
server/modules/time-entries/, client/components/TimeLogger.tsx |
| sites | Live site previews from the sandbox — tier above artifacts: agent scaffolds a real multi-file project in the conversation container, site_serve runs the server + opens a quick-tunnel preview URL (*.trycloudflare.com, workers.dev-compatible), WorkspacePanel Sites tab shows the live iframe. Preview-not-deployment by design; custom-domain forks upgrade via exposePort+proxyToSandbox. |
server/modules/chat/tools/site.ts, docs/AGENT_TOOLKIT.md §Sites |
| workspace panel + artifacts | Chat's right-hand workspace (#40) — Artifacts / Files / Activity tabs, all derived live from the message stream. Artifacts (html/svg/mermaid/markdown) get durable identity + a v1..vN version chain via the tools' best-effort D1 index, an in-panel viewer with version stepper, auto-open on create, and publish (share-tokens artifact resolver → public /share/:token serving the latest version). Foreign/unknown edit ids fork a fresh artifact — no cross-user version injection. |
client/modules/chat/components/WorkspacePanel.tsx, server/modules/artifacts/, server/modules/chat/tools/artifacts.ts |
| approvals UI | React tab at /dashboard/approvals — review + approve/reject queued agent actions, deep-link from notifications | client/modules/approvals/pages/ApprovalsPage.tsx |
| sweeper-agent | Cron-driven entity processing — recurring agent that scans entities for stale items + queues followup approvals | server/modules/autonomous-agents/sweeper-agent.ts |
| admin-agent | Claude-Code-style platform admin — chats with the user in #admin Space, proposes routines / agents / connections via 14 admin tools (8 routine, 6 awareness). All write actions gated through requestApproval. English-to-routine workflow. |
server/modules/autonomous-agents/admin-agent.ts, server/modules/admin-tools/, client/modules/admin-agent/pages/AdminAgentPage.tsx |
| organizations | Multi-tenant orgs — better-auth plugin + auto-personal-org on signup + OrgSwitcher in sidebar + /dashboard/organization (members + invites + roles) + /accept-invitation/:token public flow. Slack/Linear/Notion convention: sidebar shows tenant context, product brand stays on public surfaces. |
server/modules/organizations/, client/modules/organizations/, docs/orgs-ui-plan-2026-04-28.md |
| agent MCP integration | AutonomousAgent inherits tools from owner's connected MCP servers automatically | server/lib/agents/autonomous-agent.ts (buildToolset) |
| tool-search | Progressive tool disclosure — agent gets find_tools(query) + ~10 core tools, the rest load on demand. ~10K tokens/turn saved |
server/lib/ai/tool-search.ts, wired in chat-agent.ts |
| routines | Canonical recurring agent pattern — declarative config (agent + schedule + skills + tools allow-list + hooks). Channels-as-tools (notify / approval_queue / inbox_add / space_send / webhook_post). Run-summary tail keeps cost flat over hundreds of fires. | server/modules/routines/, client/modules/routines/, docs/ROUTINES.md |
| inbox | Single attention surface for AI-emitted items — findings + approvals merged. Approval rows open inline ApprovalSheet (no route bounce). Approvals removed as separate sidebar entry; route preserved at /dashboard/approvals for notification deep links. Sort by importance → due → created. Findings emitted by routines via inbox_add channel tool. |
server/modules/inbox/, client/modules/inbox/pages/InboxPage.tsx, client/modules/inbox/components/ApprovalSheet.tsx, client/modules/approvals/components/ApprovalCard.tsx (shared) |
| channels | Internal MCP-equivalent tools the agent dispatches findings to. Routines opt in via toolsAllowed. |
server/modules/chat/tools/channels.ts |
| connection profiles | Per-MCP-connection labels + per-agent allow-list — solves "personal Gmail vs work Gmail" cleanly. Filter applied in getUserMcpTools(env, userId, agentName). |
server/modules/mcp-connections/db/schema.ts, client/modules/connectors/components/ConnectionDetail.tsx (ProfilePanel) |
| agent metadata + registry | Every AutonomousAgent declares static metadata = { displayName, description, category }. /api/agents/registered exposes the catalogue; pickers consume it so users never see raw class names. Add an agent → metadata + import = auto-discovered. |
shared/agent/metadata.ts, server/lib/agents/registry.ts, server/lib/agents/routes.ts |
| format helpers | Single-source-of-truth translators: formatAgentClass / formatOutcome / formatTrigger / formatRole / formatImportance / formatCadenceInterval / deriveInstanceName. Stops snake_case enum strings from leaking into UI. |
shared/format/agent.ts |
| routine pickers | AgentPicker / SkillsPicker / ToolsPicker / SingleSkillPicker — replace raw text inputs in NewRoutinePage with discoverable combobox + multi-select. Tools grouped by category (Gmail / Notion / Channels / Core / etc.). | client/modules/routines/components/RoutinePickers.tsx |
| email providers | Six pluggable providers (email-service / smtp2go / mailgun / resend / email-routing-send / console), one file each, registry resolves a priority list. EMAIL_FAILOVER='true' cascades on error; EMAIL_PROVIDER_ORDER overrides priority. |
server/modules/email/providers/ |
| email delivery events | Bounce/complaint feedback loop via Queues event subscriptions — opt-in consumer records email_events + maintains the email_suppressions list; EMAIL_SUPPRESSION_ENFORCE='true' makes sendEmail() skip suppressed recipients (typed 'suppressed' result). email-service provider only. |
server/modules/email/delivery-events.ts, docs/ADDING_EMAIL_DELIVERY_EVENTS.md |
| mirror | D1 mirror pattern — keep an external reference dataset current in D1 (cron → Workflow → batched upserts + prune, per-row syncedAt freshness, admin POST /api/mirror/refresh). Swap source.ts for your API; demo mirrors restcountries.com. |
server/modules/mirror/, docs/ADDING_D1_MIRROR.md |
| batch-tasks | Durable swarm fan-out — Cloudflare Workflow processes N items in parallel windows of 8, retries per-item with exponential backoff. Used via the start_batch_task chat tool ("for each of these 50 PDFs, extract X"). Item content is loaded from R2 and converted via env.AI.toMarkdown for non-text docs. Approval-gated above 5 items. |
server/modules/batch-tasks/, server/modules/chat/tools/batch-task.ts, client/modules/jobs/pages/ |
| sandbox code-interpreter | run_python + generate_document chat tools on Cloudflare Sandbox containers — conversation-scoped sandbox (user-<id>-conv-<id>, interpreter state persists while warm), input files staged from FILES R2 (isOwnedR2Key-guarded), output paths harvested back as artifacts + registered on the Files page. generate_document renders markdown → docx/xlsx/pptx via python-docx/openpyxl/python-pptx baked into the Dockerfile (base tag must match the @cloudflare/sandbox npm version). Output matches the terminal shape renderer — zero client code. Wiring: containers block + SANDBOX DO + exports map entry + export { Sandbox }; Docker must run locally at deploy; tools self-omit without the binding (VITE_FEATURE_SANDBOX opts out). |
server/modules/chat/tools/code.ts, Dockerfile, docs/AGENT_TOOLKIT.md |
| with_review | Worker→Reviewer quality loop (OpenSwarm pair-pipeline pattern). Cheap worker drafts → smarter reviewer scores via APPROVE/REVISE/REJECT verdicts → worker rewrites with notes → cap at max_iters with optional escalation. Reviewer criteria from a Skill (review-output ships bundled) or inline prompt. Use for high-quality outputs where iteration matters. |
server/modules/chat/tools/with-review.ts, skills/review-output/ |
| always_active skills | Frontmatter always_active: true bakes a skill's full body into every chat's system prompt — bypasses load_skill. For baseline knowledge (style, persona, project glossary). Loaded via loadAlwaysActiveSkills(env, userId). |
server/lib/ai/skills/registry.ts, server/modules/chat/chat-agent.ts (section 8b) |
| hybrid memory recall | agentRecall ranks via 0.55*sim + 0.20*importance + 0.15*recency + 0.10*frequency. RECALL_WEIGHTS exposed as a constant; importance optional on agentRemember. Frequency reserved at 0 until Vectorize counter support lands. |
server/lib/agents/agent-memory.ts |
| tool-search (find + list) | find_tools(query) keyword-searches with per-token scoring (multi-word queries work); list_tools(category) paginates by name prefix (e.g. gmail_). Both core tools — always active in chat agent's prepareStep. |
server/lib/ai/tool-search.ts |
| knowledge | Long-form indexed reference docs per scope (user/project/org). FTS5-indexed, two injection modes (always bakes body into every prompt, on_demand exposes catalog the agent searches via knowledge_search + load_knowledge). Server-side cap at 50K total always-active tokens. Sits between memories (small structured facts) and skills (procedures). |
server/modules/knowledge/, client/modules/knowledge/, server/modules/chat/chat-agent.ts (section 8c) |
| voice mode | Push-to-talk + auto-TTS wrapper around the chat agent. Aura 2 default + ElevenLabs opt-in. iOS Safari unlock via primed audio element, AbortController + 25s timeout, race-safe via session counter. Distinct from VoiceDictationButton (which streams STT into the input field via DO+WS). | server/modules/voice/, client/modules/chat/components/VoiceModeButton.tsx, client/modules/chat/hooks/useVoiceChat.ts |
| tool-renderer shape tier | Generic tool-output viewers matched by output shape rather than tool name — auto-upgrades ~30 long-tail tools to rich UX with zero per-tool client code. Shapes: stdout/image/markdown/table. Registered after bespoke renderers, before defaults. pnpm tool-coverage audits the registry. |
client/modules/chat/components/tool-renderers/shapes.tsx, scripts/tool-coverage.mjs |
| access log | Cross-user activity log for app owners — GET /api/admin/access-log (auth+admin gated) over the existing activity_logs table, filterable by user/action/entity/date, actor-email enriched. Per-user /api/activity shows only your own rows; this answers "what has any user done in this app?". |
server/modules/admin/routes.ts (access-log route), client/modules/admin/pages/AccessLogPage.tsx |
| sql tools | Read-only SQL over an isolated DB (#77) — sql_query + sql_schema chat tools gated on the REFERENCE_DB binding. Isolation-over-sandboxing: the separate D1 holds only non-sensitive reference data; the hardened SELECT-only validator is defence-in-depth. {columns, rows} output auto-renders via the shape tier. |
server/lib/sql-guard.ts, server/modules/chat/tools/sql.ts, docs/AGENT_TOOLKIT.md §Read-only SQL |
| think-pilot | Pilot of @cloudflare/think — durable Actions ledger (idempotency-enforced side effects, ActionKeyConflict on key reuse), approval-gated actions with in-transcript Approve/Deny, declarative scheduled-task DSL ("every day at 07:30"), shared D1 skills registry via userSkillSource. Flag VITE_FEATURE_THINK_PILOT; page /dashboard/think-pilot. Evaluation surface for the pre-1.0 harness — ChatAgent stays the production chat path. |
server/modules/think-pilot/, docs/AGENTS.md §Think pilot |
| code-mode | Pilot of @cloudflare/codemode (#113) — code_mode chat tool: model writes ONE JS function composing catalog tools (codemode.<tool>(...)), runs in an isolated dynamic Worker (LOADER binding, network blocked, RPC-only tool dispatch). Curated 22-tool read/compute allowlist (~3.4K tokens/turn measured); needsApproval tools structurally unreachable; sandbox errors returned as tool output for self-correction. Opt-in CODEMODE=true. |
server/modules/chat/tools/code-mode.ts, docs/AGENT_TOOLKIT.md §Code Mode |
| security primitives | Single-source-of-truth guards reused across modules: scopeUser/getOrgRole (tenancy), isOwnedR2Key (R2 ownership), signValue/verifyValue (signed OAuth-redirect cookies + mcp state), isSafePublicUrl/isAllowedGitHubUrl (SSRF), escapeHtml (reflected-XSS), bytesToBase64 (large-file safe), fail-closed AGENT_ACCESS_POLICY (DO access). Full model: docs/SECURITY.md. |
server/lib/{tenancy,r2-keys,crypto,ssrf,escape-html,base64}.ts, server/index.ts |
| brains-trust pattern | After non-trivial builds, run a multi-reviewer review via 2-4 frontier models (GPT-5.5 + Opus 4.7 + DeepSeek v4 Pro/Flash) — cross-validated criticals fixed before commit; cross-validated highs before deploy. ~$0.46-$0.81/round. Codified in ~/.claude/CLAUDE.md. Audit artefacts saved to .jez/audits/<date>-brains-trust-<topic>.md. |
(process; see .jez/audits/2026-05-07-tool-ui-and-connectors-brains-trust.md for a worked example) |
Changes
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 826 lines · 14,463 tokens per session scan C 03e058819543
vite-flare-starter CLAUDE.md is an instructions file published in the GitHub repository jezweb/vite-flare-starter (48 stars, last pushed 13d ago), licensed MIT. It adds 14,463 tokens to every session, about $0.0723 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Related
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.