Borrowing it
Nothing to install: this file belongs to PerpetualSoftware/pad. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PerpetualSoftware/pad/main/CLAUDE.mdgit clone --depth 1 https://github.com/PerpetualSoftware/padWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/perpetualsoftware/pad/claude-md)<a href="https://agentmods.dev/instructions/perpetualsoftware/pad/claude-md"><img src="https://agentmods.dev/badge/instructions/perpetualsoftware/pad/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/perpetualsoftware/pad/claude-md"><img src="https://agentmods.dev/badge/instructions/perpetualsoftware/pad/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.11153 | $0.11153 |
| Opus 5.5 | $0.04461 | $0.04461 |
| Sonnet 5.5 | $0.02231 | $0.02231 |
| Haiku 4.5 | $0.01115 | $0.01115 |
Grade A, and why
pad CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 496 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pad — Development Guide
What This Is
Pad is a project management tool for developers and AI agents. Single Go binary with embedded SvelteKit web UI, SQLite storage, and multi-agent skill support (Claude Code, Cursor, Windsurf, Codex, OpenCode, Copilot, Amazon Q, Junie).
Related repo: The marketing website (getpad.dev) lives at ../pad-web — a separate SvelteKit site deployed to Vercel.
Architecture
- Backend: Go (cmd/pad/main.go) → REST API (internal/server/) → SQLite (internal/store/)
- Frontend: SvelteKit 2 + Svelte 5 (web/src/) → static build embedded in Go binary
- Data model: Workspaces → Collections (typed with JSON schemas) → Items (structured fields + rich content)
- CLI: Cobra commands in cmd/pad/main.go, HTTP client in internal/cli/
- Agent skill: Single natural-language
/padskill in skills/pad/SKILL.md
Build & Install
make build # Build web UI + Go binary (./pad)
make install # Build, kill server, install to ~/.local/bin/pad, restart
make build-go # Build Go only (skip web — faster when only backend changes)
make test # Run Go tests
make web # Build web UI only
make dev-web # Run SvelteKit dev server (hot reload on :5173)
After making changes, always run make install to rebuild the binary, install it, and restart the server. The web UI at http://localhost:7777 will reflect the changes.
Quick iteration loop
- Backend only:
make install(skips web rebuild if no frontend changes — edit Makefile to usebuild-goinstead ofbuildin the install target) - Frontend only:
make web && make installor usemake dev-webfor hot reload during development - Full rebuild:
make install
Working in a git worktree
Agent sessions take a git worktree per task rather than sharing the main checkout (a shared checkout means a shared stash stack, branch state, and dirty files across sessions). Three rules keep web tooling working there:
- Give each worktree its own
web/node_modules: runnpm ciin itsweb/. Do not symlink the main checkout's copy. It installs from the npm cache in about 5s warm, costs about 470 MB of disk per live worktree, and runssvelte-kit syncas a side effect. A symlink tests the worktree against whatever the MAIN checkout last installed.web/package-lock.jsonchanges every few days, and the main checkout is not kept current, so that is routinely the wrong dependency set: on day 86 (2026-10-05), worktrees borrowed Tiptap 3.31.3 after main had moved to 3.31.4, plus a materializer bundle built from it, and the corpus tests failed for reasons that had nothing to do with the change. SvelteKit 3 also writes its generated tsconfig insidenode_moduleswith relative paths, so through a symlink a worktree's type check would silently check the main checkout's tree (TASK-3423). (Dave's ruling, 2026-10-06. A pnpm-style shared store is the follow-up if disk becomes the constraint.) - A fresh worktree has no
web/.svelte-kit(gitignored, generated). Runnpx svelte-kit syncinweb/before any vitest/vite command — ornpm run check, which syncs first. Without it, vitest fails withFailed to load tsconfig '.svelte-kit/tsconfig.json': Tsconfig not foundregardless of hownode_moduleswas set up. (This missing generated dir was historically misdiagnosed as a symlink problem —npm ci"fixed" it only because itspreparescript runssvelte-kit sync.) - A fresh worktree has no
web/buildeither, and that one breaks the GO gates rather than the web ones.embed.godoes//go:embed all:web/build, somake testandmake lintfail withpattern all:web/build: no matching files foundbefore a single test runs —go build ./...dies first, two packages report[setup failed], and it reads as a broken tree rather than a missing generated directory.npx vite buildinweb/fixes it (make webwould too, and is FORBIDDEN here — see the next rule). It also has noweb/build-materializer(TASK-2198, gitignored, generated):embed.godoes//go:embed web/build-materializer/materializer.js, and a missing file failsgo build ./...the same way, withpattern web/build-materializer/materializer.js: no matching files found. Runnode scripts/build-materializer.mjsinweb/afternpx vite build(npm run builddoes both). It is built with esbuild, which is a devDependency of its own (vite 8 does not bring it), so aweb/node_modulesolder than the lock file that added it cannot build the bundle. Unlikeweb/build, a placeholder file here is not enough formake test:internal/materialize's tests run the real bundle.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +44 tokens per session b99da00ebd6e
- 3d ago Changed · +19 lines · +208 tokens per session 200531452aa0
- 4d ago Changed · +1 lines · +22 tokens per session 53098e5f3749
- 7d ago Changed · +14 tokens per session 03f1724a4ac8
- 18d ago Changed · +4 lines · +114 tokens per session e3fd81152482
- 19d ago Changed · -97 lines · -26,540 tokens per session scan B → A 5e9ccbfe219e
- 20d ago Changed · +14 lines · +1,765 tokens per session 9c176e3fa787
- 21d ago Changed · +7 lines · +1,126 tokens per session 5f4bdc90eb9a
- 22d ago Changed · +107 tokens per session b86a3d6d8f3f
- 24d ago First seen · 548 lines · 34,293 tokens per session scan B 834e4b50dd7a
pad CLAUDE.md is an instructions file published in the GitHub repository PerpetualSoftware/pad (198 stars, last pushed yesterday), licensed Apache-2.0. It adds 11,153 tokens to every session, about $0.0446 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
vscode model-prompts.instructions.md
Model-specific prompt authoring and registry guidelines.