freetube CLAUDE.md

A project instruction file for FreeTube iOS, a SwiftUI app that provides a YouTube-like client and downloads from many supported sites. It records the project's constraints, technology choices, and structure.

In plain words
What is it for?
Use it before editing the app to understand its supported iOS and Swift versions, distribution limits, naming conventions, and major features.
Why use it?
It gives a coding agent the context and fixed rules needed to avoid incompatible changes.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/leshkodev/freetube/claude-md
Clone the repo
git clone --depth 1 https://github.com/leshkodev/freetube
Per session 9,979 This file is loaded in full into every session.
When invoked 9,979 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.09979 $0.09979
Opus 5 $0.04990 $0.04990
Sonnet 5 $0.01996 $0.01996
Haiku 4.5 $0.00998 $0.00998

Measured yesterday against content hash c7464f3bf27d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

freetube CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

6. **Critical: `--ffmpeg-location /dev/null/no-ffmpeg` is forced**, so yt-dlp's Python-side ffmpeg merger never runs. yt-dlp's `subprocess.Popen` against ffmpeg reliably hangs Python in `Popen.communicate` on iOS. We mux
CLAUDE.md · 514 lines

How it starts

The opening of the file, as written. The whole thing — 514 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file gives Claude Code the context, constraints, and conventions it must follow when working in this repository. Read it fully before touching any code. Re-read it when starting a new session.


1. What this project is

FreeTube iOS — a native SwiftUI YouTube client that replicates the YouTube mobile app: home feed, search, playback, login, subscriptions, library, history, playlists, comments, likes, downloads. Plus a "Link" tab for downloading from any of ~2,000 sites supported by yt-dlp.

Distribution: TestFlight internal, sideload, or personal use. Not for public App Store submission. Do not suggest changes that assume App Store distribution.

Platforms: iOS 17.0+, Swift 5.9+, Xcode 15+.

Bundle identifier: com.leshko.freetube. This is also the reverse-DNS namespace for the os.Logger subsystem, the Keychain cookie key (com.leshko.freetube.cookies), the UserDefaults keys (subscriptions / downloads / metadata), and internal Notification.Names. Keep all of them on this same domain. Changing the identifier invalidates provisioning profiles and resets Keychain / UserDefaults state for any prior install.


2. Non-negotiable constraints

These come first. Violating them breaks the project.

  1. No Google Cloud YouTube Data API. All YouTube interaction goes through b5i/YouTubeKit (cookie-based, no API key). Never suggest GoogleAPIClientForREST, YTPlayerView, IFrame embeds, or https://www.googleapis.com/youtube/v3/....
  2. No dimitris-c/AudioStreaming. It is for raw audio streams (Icecast/Shoutcast). YouTube serves HLS/DASH. Playback uses AVPlayer only.
  3. No App Store assumptions. Do not add capabilities, entitlements, or workarounds aimed at App Store review (e.g. avoiding WKWebView cookie reads, hiding download functionality). Sideload-honest behavior is expected.
  4. No telemetry, analytics, or remote logging by default. Logs go to os.Logger only. Never add SDKs that beacon out.
  5. Cookies are sensitive. Always store in Keychain via KeychainHelper. Never write them to disk, UserDefaults, plist, or logs. Never print cookie values.
  6. Signed stream URLs are sensitive and time-limited. Never persist them. In-memory cache only (StreamURLCache), 30-minute TTL max.
  7. MVVM with service layer is mandatory. Views do not import YouTubeKit or YoutubeDL. ViewModels do not perform networking directly — they call services in Core/Networking/.
  8. SwiftUI only for UI. No UIKit UIViewController subclasses except where bridging is unavoidable (AVPlayerViewController, WKWebView, AVPictureInPictureController). Wrap those in UIViewControllerRepresentable / UIViewRepresentable.
  9. Swift Concurrency is the default. Use async/await and AsyncSequence. Use Combine only inside PlayerStateManager for AVPlayer time observation. Do not introduce RxSwift.
  10. No force unwraps in production code. Use guard let, if let, or proper throw. Force unwraps allowed only in test fixtures.
  11. @Observable is the default for view models, not ObservableObject. Injected through SwiftUI @Environment(...).

Read the full file on GitHub · 514 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 514 lines · 9,979 tokens per session scan A c7464f3bf27d

Subscribe to this mod's changes

freetube CLAUDE.md is an instructions file published in the GitHub repository leshkodev/freetube (183 stars, last pushed 1mo ago), licensed MIT. It adds 9,979 tokens to every session, about $0.0499 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.