ZackEyes CLAUDE.md

ZackEyes CLAUDE.md is an instructions file for coding agents from yangshiqi/ZackEyes. It costs 1,640 tokens per session, scanned B, original, MIT.

Project instructions for ZackEyes, a Swift application with an app target and a bridge that handles coding-agent hook events. A hook is an automatic action triggered by an event such as starting or ending a session.

In plain words
What is it for?
Use them when changing ZackEyes, building its app bundle, running module-specific tests, or manually testing the bridge with session events.
Why use it?
They tell an agent which project documents to read, how to build and test the application, and how to simulate Claude Code or Codex hook calls.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/yangshiqi/zackeyes/claude-md
Clone the repo
git clone --depth 1 https://github.com/yangshiqi/ZackEyes

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ZackEyes CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/yangshiqi/zackeyes/claude-md.svg)](https://agentmods.dev/instructions/yangshiqi/zackeyes/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/yangshiqi/zackeyes/claude-md"><img src="https://agentmods.dev/badge/instructions/yangshiqi/zackeyes/claude-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 1,640 This file is loaded in full into every session.
When invoked 1,640 The same file — it is already loaded in full.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01640 $0.01640
Opus 5 $0.00820 $0.00820
Sonnet 5 $0.00328 $0.00328
Haiku 4.5 $0.00164 $0.00164

Measured 5d ago against content hash 8a85f6862303, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade B, and why

ZackEyes CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

1. **用户配置零损坏** — Hook installer 操作用户配置文件时(`~/.claude/settings.json` for HookInstaller,`~/.codex/hooks.json` for CodexHookInstaller):必须先备份(`{file}.backup.{timestamp}`)、只追加 hooks key 不动其他字段(Claude: `permissions`、`enabledPl
CLAUDE.md · 77 lines

How it starts

The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

上下文分层

Tier 加载时机 文件
Tier 1 热加载 每次对话自动加载 CLAUDE.md(本文件)
Tier 2 按需读取 修改代码前 / 开始任务前 ARCHITECTURE.md, AGENTS.md
Tier 3 深度参考 需要时主动查询 docs/superpowers/specs/, .claude/memory/, git log

引用指令:

  • 修改代码前必读 ARCHITECTURE.md — 组件边界、数据流、安全模型
  • 开始任务前必读 AGENTS.md — 开发流程、反馈循环、变更检查清单

Build & Dev Commands

# 编译
swift build                  # Debug build (两个 target: ZackEyes + bridge)
make app                     # Build + 组装 .app bundle

# 运行
make run                     # Build + open .build/ZackEyes.app

# 测试
swift test                   # 全量测试 (SharedTests + BridgeLibTests + AppLibTests)
swift test --filter SharedTests      # 仅 Shared 模块
swift test --filter BridgeLibTests   # 仅 Bridge 模块
swift test --filter AppLibTests      # 仅 App 模块

# Bridge 手动测试 (模拟 Claude Code hook 调用)
echo '{"hook_event_name":"SessionStart","session_id":"test","cwd":"/tmp"}' | \
  $(swift build --show-bin-path)/bridge --event SessionStart --agent claude

# 模拟 Codex hook 调用
echo '{"hook_event_name":"Stop","session_id":"test","cwd":"/tmp","last_assistant_message":"done"}' | \
  $(swift build --show-bin-path)/bridge --event Stop --agent codex

# 清理
make clean

Mandatory Invariants

任何代码变更 MUST 遵守以下所有约束:

  1. 用户配置零损坏 — Hook installer 操作用户配置文件时(~/.claude/settings.json for HookInstaller,~/.codex/hooks.json for CodexHookInstaller):必须先备份({file}.backup.{timestamp})、只追加 hooks key 不动其他字段(Claude: permissionsenabledPluginsdefaultMode...;Codex: 用户已有的 hook 条目)、JSON 解析失败时不修改原文件。永远不读不写 ~/.codex/config.toml(codex [features].hooks 默认 true,碰它会引入 TOML 解析依赖 + 用户配置损坏风险)。
  2. Bridge 永不污染 agent 终端 — Bridge 进程的任何受控失败路径必须以 exit(0) 退出且不写 stdout/stderr。Claude Code 新版把任何非 0 exit 显示成 hook error;Codex 同样宽容地处理 exit 0。Socket 连不上、超时、stdin 异常、未知 --agent 值 → 静默 exit(0)。永远不使用 exit(2)(阻塞错误)。PermissionRequest 失败时 exit 0 无 stdout → agent 回退到原生终端授权,行为正确。
  3. NotchPanel 不抢焦点 — NSPanel 必须是 nonactivatingPanelcanBecomeMain 返回 false。Collapsed/Compact 状态下 ignoresMouseEvents = true,只有 Expanded 状态才接收交互。
  4. Socket 连接不复用 — 每次 hook 调用创建新连接,用完即关。防止连接泄漏和状态混淆。
  5. Hook 配置可识别 — 注入到 settings.json / hooks.json 的 hook entries,command 路径必须包含 zackeyes 字符串 + 显式 --agent claude|codex flag,用于安全移除时精确匹配。Bridge 缺 --agent 时默认 claude,保证老 hook entry 升级时不掉链。
  6. 零第三方依赖 — MVP 阶段只使用 Foundation + AppKit + SwiftUI。不引入 Sentry、Sparkle、CocoaPods、SPM 外部包。
  7. 存活判定必须按 agent 取各自的信号runLivenessSweepLivenessFilter.filterLiveDetected 对两个 agent 分别取快照(runningClaudeCwds / runningClaudePidSetrunningCodexCwds / runningCodexPidSet)。把一个 agent 的 session 喂进另一个 agent 的 map/PID set 会全部判死。另有三条不能破:
    • codex cwd == nil 的 session 保留 15 min idle 兜底剪枝 —— 它进不了 ps 路径,删掉这条兜底,codex TUI 退出后卡片永不消失。
    • 只有来自 hook _bridge_ppid 的 PID 有判活权claudePidFromHook)。activateDetectedSessions 会按 cwd 猜一个同目录的 agent 进程填进 claudePid,那个猜测值只能用于终端跳转;拿它判活会让「猜错的兄弟进程退出」剪掉活会话(#217)。
    • 任一快照返回 nil(ps/lsof 失败)时一律保守留人 —— 尤其不能把有 PID 的 session 改判到 cwd 启发式上,那等于把 #217 放回来。下一个 tick 重试即可。

Read the full file on GitHub · 77 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 77 lines · 1,640 tokens per session scan B 8a85f6862303

Subscribe to this mod's changes

ZackEyes CLAUDE.md is an instructions file published in the GitHub repository yangshiqi/ZackEyes (2 stars, last pushed 1mo ago), licensed MIT. It adds 1,640 tokens to every session, about $0.0082 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.