ship CLAUDE.md

Repository instructions for Ship, an SDK and command-line tool for deploying websites with the ShipStatic service. They describe its source layout, shared code, browser support, releases, and architecture.

In plain words
What is it for?
Working on Ship's API, deployment pipeline, browser and Node.js code, validation, packaging, branches, and versioned releases.
Why use it?
They provide the context and rules needed to change the SDK or command-line tool without breaking its supported environments or release process.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/shipstatic/ship/claude-md
Clone the repo
git clone --depth 1 https://github.com/shipstatic/ship
Per session 32,334 This file is loaded in full into every session.
When invoked 32,334 The same file — it is already loaded in full.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.32334 $0.32334
Opus 5 $0.16167 $0.16167
Sonnet 5 $0.06467 $0.06467
Haiku 4.5 $0.03233 $0.03233

Measured 2d ago against content hash cb3fdeb1fa22, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

ship CLAUDE.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

0600 "like `~/.netrc`" while the reader accepted the same credential from a
CLAUDE.md · 2,000 lines

How it starts

The opening of the file, as written. The whole thing — 2,000 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

Claude Code instructions for the Ship SDK & CLI package.

@shipstatic/ship — universal SDK and CLI for ShipStatic. Clean resource.action() API, identical in Node.js and Browser. Maturity: Stable; semver applies — breaking changes require a major version bump.

Branches: main (production) + development (integration). The publish workflow runs on both — the guarded publish step publishes only when package.json holds a version not yet on the registry, with the dist-tag derived from the version (- suffix → beta, else latest). See root CLAUDE.md "Branch & CI Model".

Architecture

src/
├── shared/              # Cross-platform code (70% of codebase)
│   ├── api/http.ts      # The transport: headers, retries, timeout, events
│   ├── base-ship.ts     # Base Ship class (auth state, lazy /limits fetch, resources)
│   ├── resources.ts     # Resource factories — every endpoint, stated once
│   ├── types.ts         # Internal SDK types
│   ├── core/            # constants, credential schema, the deploy body + file pipeline
│   └── lib/             # Utilities (validation, junk filtering, MD5, SPA detection)
├── browser/             # Browser Ship class + the `webkitRelativePath` read
└── node/
    ├── core/config.ts       # readEnvConfig — SHIP_* env-var resolution (no filesystem)
    ├── core/node-files.ts   # the filesystem walk (the pipeline itself is shared)
    └── cli/
        ├── bin.ts           # THE EXECUTABLE (dist/cli.cjs) — the only file with side effects
        ├── index.ts         # Commander.js command tree + withErrorHandling + performDeploy
        ├── create-client.ts # Credential precedence (flag → env → file) → Ship instance
        ├── shiprc.ts        # ~/.shiprc + --config reader (strict JSON) — CLI ONLY
        ├── config.ts        # Interactive `ship config` wizard
        ├── error-handling.ts # toShipError + getUserMessage (TEXT channel)
        ├── formatters.ts    # announce() + the render router
        ├── utils.ts         # Output primitives (success/error/info, table, details)
        ├── types.ts         # CLI option + result types
        ├── completions.ts   # Shell completion scripts, RENDERED from the tree
        └── completion.ts    # Shell completion install/uninstall

Read the full file on GitHub · 2,000 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 2,000 lines · 32,334 tokens per session scan C cb3fdeb1fa22

Subscribe to this mod's changes

ship CLAUDE.md is an instructions file published in the GitHub repository shipstatic/ship (5 stars, last pushed 2d ago), licensed MIT. It adds 32,334 tokens to every session, about $0.1617 per session on Opus 5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other instructions, from other repositories

mcp CLAUDE.md

Instructions for shipstatic/mcp, covering claude.md, readme positioning (public docs), architecture, one product, two transports — the shape that survives oauth and quick reference.

shipstatic/mcp · 9,447 tokens

mcp AGENTS.md

Instructions for shipstatic/mcp: Read CLAUDE.md (same directory). It is the single source of truth for this repo's instructions; everything in it applies to every agent, not just Claude. Do not duplicate its content here.

shipstatic/mcp · 55 tokens

notebooklm-py AGENTS.md

Instructions for teng-lin/notebooklm-py, covering repository guidelines, project structure & module organization, build, test, and development commands, coding style & naming conventions and testing guidelines.

teng-lin/notebooklm-py · 744 tokens

skills copilot-instructions.md

Copilot instructions for microsoft/skills, covering copilot instructions for agent skills, project overview, ⚠️ fresh information first, core principles and 1. think before coding.

microsoft/skills · 2,575 tokens

ApplicationInsights-dotnet AGENTS.md

Instructions for microsoft/ApplicationInsights-dotnet, covering agents.md, repository structure, build & test, ai-assisted instrumentation skills and what it does.

microsoft/ApplicationInsights-dotnet · 811 tokens

openapi CLAUDE.md

Instructions for longbridge/openapi, covering agent guidelines, after modifying rust code, after modifying the node.js sdk (nodejs/), after modifying the python sdk api (python/) and after modifying the c sdk (c/).

longbridge/openapi · 1,265 tokens