webspace_app: Instructions file for Claude Code

CLAUDE.md

webspace_app CLAUDE.md is an instructions file for Claude Code from theoden8/webspace_app. It costs 30,549 tokens per session, scanned D, original, MIT.

A set of project instructions for developing the WebSpace Flutter app. It describes the app, supported platforms, coding and output conventions, Git rules, and its pinned Flutter version.

In plain words
What is it for?
Use it when developing, testing, translating, or committing changes in the WebSpace Flutter project.
Why use it?
It gives a coding agent the project-specific constraints needed to work safely and consistently. This includes rules about branches, commits, translations, and platform behavior.

Instructions file for Claude Code

Written for Claude Code: the file is CLAUDE.md. Also seen: mentions CLAUDE.md; mentions subagents.

This is theoden8/webspace_app's own configuration. It tells Claude Code how to work on webspace_app itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything webspace_app configures →

Reuse

Borrowing it

Nothing to install: this file belongs to theoden8/webspace_app. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/theoden8/webspace_app/master/CLAUDE.md
Clone the repo
git clone --depth 1 https://github.com/theoden8/webspace_app

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for webspace_app CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/theoden8/webspace_app/claude-md/github.svg)](https://agentmods.dev/instructions/theoden8/webspace_app/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/theoden8/webspace_app/claude-md"><img src="https://agentmods.dev/badge/instructions/theoden8/webspace_app/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for webspace_app CLAUDE.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/theoden8/webspace_app/claude-md"><img src="https://agentmods.dev/badge/instructions/theoden8/webspace_app/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 30,549 This file is loaded in full into every session.
When invoked 30,549 The same file — it is already loaded in full.
Security scan D 3 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.30549 $0.30549
Opus 5.5 $0.12220 $0.12220
Sonnet 5.5 $0.06110 $0.06110
Haiku 4.5 $0.03055 $0.03055

Measured today against content hash b72376561cee, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade D, and why

webspace_app CLAUDE.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

sudo apt-get install -y pipewire pipewire-bin wireplumber dbus-daemon jq \

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -fsSL https://fvm.app/install.sh | bash

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL https://fvm.app/install.sh | bash
CLAUDE.md · 871 lines

How it starts

The opening of the file, as written. The whole thing — 871 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

WebSpace: Flutter app managing multiple websites with per-site cookie isolation via flutter_inappwebview. Platforms: iOS, Android, macOS, Linux (WPE WebKit fork).

Coding principles

Simplicity comes first: every structure here exists to make the code easier to hold in the head; one that makes it harder has failed, however correct it is. Within that: one owner per fact, joins are types, and every invariant is caught at the earliest point it can be violated. A bug then has one suspect.

Reasoning stays local as the system grows. Adding a component costs the same to write, to read and to check, whatever else exists. Components meet only through what they share, so the first question for any new piece is what it shares with the rest, and a good answer is small and explicit. Interleavings multiply with every component that touches the same state: two pieces that share nothing can be understood and checked apart, and two that share a variable must be understood and checked together. A design in which every new piece interacts with every old one has stopped scaling, however correct each piece is.

Design is proved by the compiler and timing by the model checker, each over its own unit: a type for a fact, and for timing what runs between two awaits. The model is printed from the code, so when the two disagree the suspects are the code, the printer and the fakes, never the printed text, and the trace names which. A check counts once it has caught a planted mistake, and the mistake stays as its proof. Debt is a list in a gate that only shrinks. Verification only grows: a refactor prints the same model and still catches every planted mistake, no count of checks, mistakes caught or obligations proved falls (formal/levels.tsv), and a check retires only when its replacement has caught the same mistakes.

The ladder

Each invariant sits on one rung. Put it on the highest rung Dart allows; step down only with a one-line reason next to the check.

Read the full file on GitHub · 871 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +4 lines · +303 tokens per session b72376561cee
  2. 2d ago Changed · +5 lines · +489 tokens per session 368e1f5e7c0b
  3. 5d ago Changed · +2 lines · +371 tokens per session 031f6e152268
  4. 6d ago Changed · +14 lines · +1,945 tokens per session scan C → D c9daa059460a
  5. 8d ago Changed · +2 lines · +298 tokens per session 2eef3471731c
  6. 9d ago Changed · +6 lines · +719 tokens per session 9f33ba54a1b3
  7. 11d ago Changed · +1 lines · +172 tokens per session f987ab2b43ab
  8. 12d ago Changed · +25 tokens per session 5b082197efcd
  9. 14d ago Changed · +4 lines · +625 tokens per session c798edbe8ecd
  10. 15d ago First seen · 833 lines · 25,602 tokens per session scan C cf80170adf63

Subscribe to this mod's changes

webspace_app CLAUDE.md is an instructions file published in the GitHub repository theoden8/webspace_app (220 stars, last pushed yesterday), licensed MIT. It adds 30,549 tokens to every session, about $0.1222 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

webspace_app CLAUDE.md compared with instructions from other repositories

webspace_app CLAUDE.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
webspace_app CLAUDE.mdtheoden8/webspace_appInstructions file220yesterdayMITD30,549Claude Code
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149ktodayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode