workframe: Instructions file for Claude Code

CLAUDE.md

workframe CLAUDE.md is an instructions file for Claude Code from ryanzhao1011/workframe. It costs 1,373 tokens per session, scanned A, original, MIT.

Repository maintenance instructions for Workframe, a Claude Code plugin marketplace containing a user-level launcher and a project-level toolkit. They define validation, versioning, asset, and changelog rules for contributors.

In plain words
What is it for?
Use them when modifying Workframe plugins, marketplace metadata, documentation, rules, templates, skills, hooks, scripts, or release changelogs.
Why use it?
They reduce release mistakes by requiring consistent versions, checking installed assets, and running one defined validation command before submission.

Instructions file for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT} variable. Also seen: mentions .claude-plugin; mentions Claude Code.

This is ryanzhao1011/workframe's own configuration. It tells Claude Code how to work on workframe itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything workframe configures →

Runs only inside a plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else, and the catalogue could not identify which plugin ships it.

Reuse

Borrowing it

Nothing to install: this file belongs to ryanzhao1011/workframe. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ryanzhao1011/workframe/main/CLAUDE.md
Clone the repo
git clone --depth 1 https://github.com/ryanzhao1011/workframe

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for workframe CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/ryanzhao1011/workframe/claude-md/github.svg)](https://agentmods.dev/instructions/ryanzhao1011/workframe/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/ryanzhao1011/workframe/claude-md"><img src="https://agentmods.dev/badge/instructions/ryanzhao1011/workframe/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for workframe CLAUDE.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/ryanzhao1011/workframe/claude-md"><img src="https://agentmods.dev/badge/instructions/ryanzhao1011/workframe/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 1,373 This file is loaded in full into every session.
When invoked 1,373 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01373 $0.01373
Opus 5.5 $0.00549 $0.00549
Sonnet 5.5 $0.00275 $0.00275
Haiku 4.5 $0.00137 $0.00137

Measured 20d ago against content hash c1a3510ab240, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

workframe CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 58 lines

How it starts

The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Workframe — 仓库维护约定

面向本仓的贡献者与协作 AI。改这个仓之前读这份;使用框架的说明在 docs/。

这是什么

一个 Claude Code 插件市场仓,含两个插件:workframe-launcher(用户级,管「怎么开局」)与 core(项目级,管「项目里怎么干活」)。用户装的是插件,不是这个仓——仓库结构对用户不可见,插件内容才可见。这条区分决定了下面多数约束。

plugins/workframe-launcher/   用户级入口插件
plugins/core/                 项目级插件:agents / skills / context / hooks / scripts / templates / reference
tools/                        validate.py(唯一质量闸)与配套单测
docs/                         用户文档
.claude-plugin/               市场元数据

四条硬约束

  1. python tools/validate.py 必须全绿才能提交。它是本仓唯一的质量闸;自身只用标准库,但它以子进程跑的收口闸单测有一组需要 PyYAML(pip install pyyaml==6.0.2,CI 装的就是这一版),没装时那一组会整组报红——「没跑」不等于「通过」。这是贡献者的前置依赖,不是用户装框架的前置依赖。如果你的改动需要放宽某道护栏,多半说明护栏该重新瞄准而不是删掉——在 PR 里说明理由。
  2. 发版锁步:两个插件、市场元数据、README 状态行同版本一起 bump。version 是用户感知「有更新」的唯一信号,且按插件各自独立,锁步是为了不让任何一边的用户被静默落下(check_version_consistency 强制)。
  3. plugins/core/{templates,skills,context}/ 下的资产会装到用户机器,不得引用仓内路径(check_core_assets_no_repo_internal_path 强制)。用户那里没有 tools/、没有 docs/,写了就是死引用。
  4. 新增检查必须用它自己的失败方式打一遍(二检)。「写完了但从没被真正执行过」的检查与通过长得一模一样——本仓踩过多次,包括一次改动误删赋值导致某检查全程失效、而当时全部闸显示绿灯。

两份 CHANGELOG

本仓的 CHANGELOG.md 是对外发布说明,回答用户一个问题:升级后我要改变什么行为。

写 不写
内容 破坏性变更(置顶)、新能力、升级要做的动作、已知限制 内部里程碑代号、审查过程、失败的尝试、提交号、内部文档路径
粒度 一个版本一段,按用户可感知的能力分组 逐提交流水
时机 只在发版时写一次——平时的改动记在维护者账本里,发版时从中提炼 每改一次就往对外版追加(这样必然碎、必然漂)

未发布段的数字必须跟着代码走。 判据是段标题有没有 ISO 日期:

  • ## [Unreleased] / ## [1.0.0] — 未发布 → 未发布,段内的 hook 段数、skills 数、检查数、角色数由 check_unreleased_changelog_numbers 逐个对账
  • ## [1.0.0] — 2026-09-01 → 已发布,历史账,永久豁免——它记的是当时的状态,倒改等于篡改历史

打 tag 当天把「未发布」换成实际日期,该段自动转为历史账。不需要改任何检查代码。

引号内的数字按引述处理,不参与对账:讲「模板里删掉了『36 skills』这个数字」时,说的是被删掉的旧内容,不是对当前状态的断言。

提交与平台

  • 改了必载纪律的源,下一次会话才生效——plugins/core/context/ 下的源由启动时的 hook 打包投递,项目里没有副本。改完当轮不生效,别在同一个会话里验它。
  • Windows 上写文件一律钉 newline=""。Python 文本模式默认把 LF 转成 CRLF,一次写入就让整个文件产生 diff,真实改动被淹没。check_text_writes_pin_newline 扫 plugins/ 与 tools/ 下所有写入点。
  • hooks 保持 shell-form,不要迁 exec form——双包装器设计依赖 shell 的扩展名解析,exec form 无法用一份跨平台 hooks.json 表达。
  • ${CLAUDE_PLUGIN_ROOT} 只注入 hook / MCP / LSP 子进程,Bash 工具子进程不在官方承诺内。skill 里定位插件根一律用 plugin-root.txt 配方(check_no_plugin_root_env_in_skills 强制)。

Read the full file on GitHub · 58 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 20d ago Changed · +93 tokens per session c1a3510ab240
  2. 1mo ago First seen · 58 lines · 1,280 tokens per session scan A 3d6861556779

Subscribe to this mod's changes

workframe CLAUDE.md is an instructions file published in the GitHub repository ryanzhao1011/workframe (7 stars, last pushed 21d ago), licensed MIT. It adds 1,373 tokens to every session, about $0.0055 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other instructions, from other repositories

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 9,649 tokens

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,384 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).

microsoft/vscode · 5,262 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,680 tokens

vscode copilot-instructions.md

Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).

microsoft/vscode · 2,731 tokens

deno copilot-instructions.md

Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.

denoland/deno · 3,077 tokens