sandcastle: Instructions file for Claude Code

CLAUDE.md

sandcastle CLAUDE.md is an instructions file for Claude Code from mattpocock/sandcastle. It costs 1,286 tokens per session, scanned A, original, MIT.

Repository instructions for Sandcastle, including its coding checks, issue-tracking process, labels and domain documentation. Changesets are small files that record user-facing package changes for release management.

In plain words
What is it for?
Use them when fixing bugs, adding features, updating public behavior, or preparing a contribution.
Why use it?
They help contributors follow the project's review and release rules and avoid undocumented public changes.

Instructions file for Claude Code

Written for Claude Code: the file is CLAUDE.md.

This is mattpocock/sandcastle's own configuration. It tells Claude Code how to work on sandcastle itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything sandcastle configures →

About the project

Sandcastle is a TypeScript library that runs AI coding agents inside isolated sandboxes and merges their branch changes back into a project. It is used to run agents in parallel, build review pipelines, or coordinate agent work through providers such as Docker, Podman, or Vercel.

mattpocock/sandcastle · 8,876 stars · on GitHub

Reuse

Borrowing it

Nothing to install: this file belongs to mattpocock/sandcastle. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/mattpocock/sandcastle/main/CLAUDE.md
Clone the repo
git clone --depth 1 https://github.com/mattpocock/sandcastle

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for sandcastle CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/mattpocock/sandcastle/claude-md/github.svg)](https://agentmods.dev/instructions/mattpocock/sandcastle/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/mattpocock/sandcastle/claude-md"><img src="https://agentmods.dev/badge/instructions/mattpocock/sandcastle/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for sandcastle CLAUDE.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/mattpocock/sandcastle/claude-md"><img src="https://agentmods.dev/badge/instructions/mattpocock/sandcastle/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 1,286 This file is loaded in full into every session.
When invoked 1,286 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01286 $0.01286
Opus 5.5 $0.00514 $0.00514
Sonnet 5.5 $0.00257 $0.00257
Haiku 4.5 $0.00129 $0.00129

Measured 3d ago against content hash 4f1867925d79, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

sandcastle CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 42 lines

How it starts

The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Use npm run typecheck for type checking. Before you finish a change, run npm test, then the verify skill on the agent × sandbox combination it touches.

tsc is TypeScript 7 (the @typescript/native alias of typescript@7). The typescript package name is an alias of @typescript/typescript6, because TypeScript 7 has no JS API and tsup's declaration build still requires one. Don't import typescript in our own code, and drop the alias once tsup no longer needs it.

Releasing: before merging the changesets Version Packages PR, run npm run test:local (real Docker and Podman; CI never runs it). See docs/agents/releasing.md.

Check ./GLOSSARY.md for terminology questions.

For user-facing changes, add a changeset to .changeset. Check all changesets there first to see if there are duplicates. We use @changesets/cli, but you can create/edit the file manually. Make all bugfixes patch, all new features or breaking changes minor (since we're pre-1.0). Use package.json#name for the name.

When changing public-facing behavior, check the user docs in docs/guide/ to see if they need updating.

User docs

The user docs are the markdown pages in docs/guide/. aihero.dev/sandcastle renders them as a docs site, and README.md links to them.

  • One page per major term in GLOSSARY.md, at docs/guide/<slug>.md, with its related terms folded in. The file name is the page's URL: docs/guide/prompts.md is aihero.dev/sandcastle/prompts. The first line is the page's # Title, and its sections are ## and below.
  • A term page opens with a short runnable example, then the details, then a ## Related terms list of links. It does not repeat definitions: those live on one page.
  • docs/guide/glossary.md (last in the Reference group) defines each user-facing term for readers, one ## Term entry each, in alphabetical order. It is hand-written, not copied: GLOSSARY.md stays the agents' source, and each entry's name must be a term GLOSSARY.md defines. When a term is added, renamed or changes meaning in GLOSSARY.md, update its entry.
  • On every other guide page, the first mention of each glossary term links to its entry ([worktrees](./glossary.md#worktree)). A mention is the entry's name, whole word, case-insensitive, plural allowed (-s, -es, -y to -ies), outside code, headings and other links; a hyphen joins words, so no-sandbox is not a mention of sandbox, and a longer term wins, so agent provider is not a mention of agent. If a word is a mention by these rules but means something else (an interactive "prompt"), reword it.
  • Explain each term once in the guide, at its home: its first mention on the earliest page in toc.json order that mentions it. Weave one or two plain sentences into the prose there (keep the link); every other page only links it. Each glossary entry ends First explained in [<Page title>](./<page>.md).
  • Never reference ADRs from the user docs (docs/guide/, README.md): no docs/adr/ links, no "ADR 0018". Keep any reasoning a reader needs in plain words.
  • The toc.json groups follow GLOSSARY.md's groups. The start page (getting-started) and the Reference group (run, every RunOptions option and result field, cli, and glossary) are not term pages. Each option is explained on its term page, and listed once in the reference.
  • docs/guide/toc.json orders and groups the pages for the sidebar. start is the page a new reader opens first. groups lists every other page as { "title": "...", "pages": ["slug", ...] }, in sidebar order.
  • To add a page, write docs/guide/<slug>.md, add its slug to a group in toc.json, and link it from the Documentation list in README.md. Renaming or removing a page touches the same three places.
  • Link between pages with relative paths (./prompts.md#built-in-prompt-arguments), and to other repo files relative to the page (../../src/sandboxes/docker.ts).
  • tests/docs-guide.test.ts fails when the three drift apart: a page missing from toc.json or README.md, a listed page with no file, a page without its # Title, a glossary entry whose name GLOSSARY.md does not define, a glossary.md#… link anywhere in docs/ or the README to an entry that does not exist, a first mention of a glossary term that is not linked, a glossary entry whose First explained in line does not name its home, an ADR reference in the user docs, or a relative link to a file or a guide heading that does not exist.

Read the full file on GitHub · 42 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago Changed · +8 lines · +616 tokens per session 4f1867925d79
  2. 4d ago Changed · +10 lines · +328 tokens per session 0367df8ef70f
  3. 5d ago Changed · +2 lines · +83 tokens per session 3cc34d00da43
  4. 6d ago Changed · +26 tokens per session b3721a780eba
  5. 2mo ago First seen · 22 lines · 233 tokens per session scan A 336a6442a970

Subscribe to this mod's changes

sandcastle CLAUDE.md is an instructions file published in the GitHub repository mattpocock/sandcastle (8,876 stars, last pushed yesterday), licensed MIT. It adds 1,286 tokens to every session, about $0.0051 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

sandcastle CLAUDE.md compared with instructions from other repositories

sandcastle CLAUDE.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
sandcastle CLAUDE.mdmattpocock/sandcastleInstructions file8.9kyesterdayMITA1,286Claude Code
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode