standup CLAUDE.md

Project instructions for maintaining Standup, a small Python tool that reports team stand-up information from history files.

In plain words
What is it for?
Use them when editing the hooks, commands, or plugin manifest, and before committing changes.
Why use it?
They prevent missed version bumps and catch broken parsing, scoring, manifest, or empty-history behavior before changes are released.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/omrigm/standup/claude-md
Clone the repo
git clone --depth 1 https://github.com/OmriGM/standup
Per session 972 This file is loaded in full into every session.
When invoked 972 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00972 $0.00972
Opus 5 $0.00486 $0.00486
Sonnet 5 $0.00194 $0.00194
Haiku 4.5 $0.00097 $0.00097

Measured 2d ago against content hash 0e63d0016586, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

standup CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 77 lines

How it starts

The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Working on standup

One Python file, hooks/standup.py, plus the manifests around it. No dependencies beyond the standard library, and that is a feature worth protecting.

Before every commit

python3 hooks/standup.py self-check          # asserts the scoring and parsing logic
python3 .github/check_manifests.py           # asserts the manifest invariants
HOME="$(mktemp -d)" python3 hooks/standup.py report   # must render from an empty history

CI runs all three, plus the version check below. Run them locally first.

Bump the version. Every time.

If you change anything under hooks/, commands/ or .claude-plugin/, bump version in .claude-plugin/plugin.json in the same commit.

Installs are cached per version. A change pushed under an unchanged version reaches nobody, and it looks like it worked. This has already happened: three commits shipped under a stale 0.1.1 and no user ever saw them.

.github/check_version_bumped.py fails the build if you forget. Do not work around it.

Everything after the bump is automatic. Push to main and the release workflow tags the commit and publishes a GitHub Release. Never create a release by hand.

Traps this codebase has already fallen into

Each of these shipped once. They are cheap to reintroduce and hard to spot.

  • CSS animation fill-mode: both outranks :hover. A filled animation keeps applying its final transform and opacity forever, beating any normal declaration. It silently killed the card hover lift and the dimming of hidden cards. Use backwards for staggered entrances, so the delay is covered and the property is released afterwards.
  • @media (prefers-reduced-motion) must stay at the very end of the stylesheet. At equal specificity the later rule wins, so overrides placed above the rules they override do nothing at all.
  • CSS beats SVG presentation attributes. .ico { fill: currentColor } overrides fill="none" on a symbol and renders outline icons as solid shapes. Style them with a class instead.
  • Python 3.9 is the floor and it is tested in CI. No backslashes inside f-string expressions, which only became legal in 3.12. A local ast.parse(feature_version=(3,9)) does not catch this; only a real 3.9 interpreter does.
  • Never declare hooks/hooks.json under manifest.hooks. That path loads automatically, and naming it again makes Claude Code load it twice and refuse the plugin. manifest.hooks is only for hook files outside the standard location.
  • Round components, not the total. The impact score is the sum of the parts its tooltip prints. Rounding the total instead makes badges that cannot be added up.
  • The tool must never record its own runs. report --summaries shells out to claude, which leaves a transcript. It is skipped via SENTINEL, both on write and on read.

Read the full file on GitHub · 77 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 77 lines · 972 tokens per session scan A 0e63d0016586

Subscribe to this mod's changes

standup CLAUDE.md is an instructions file published in the GitHub repository OmriGM/standup (1 stars, last pushed 24d ago), licensed MIT. It adds 972 tokens to every session, about $0.0049 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.