norma CLAUDE.md

norma CLAUDE.md is an instructions file for coding agents from yanlingLabs/norma. It costs 3,053 tokens per session, scanned A, original, Apache-2.0.

Repository instructions for Norma, a macOS AI assistant with a TypeScript/Bun background service and a Swift menu-bar app. They document commands, tests, communication between parts, and required code generation.

In plain words
What is it for?
Installing dependencies, running all or selected tests, verifying real compiled workflows, changing the JSON-RPC protocol, regenerating related files, and working on the Swift app.
Why use it?
They give coding agents the project’s exact development and verification rules. This reduces mistakes such as running tests with the wrong tool or forgetting to regenerate protocol files after changes.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/yanlinglabs/norma/claude-md
Clone the repo
git clone --depth 1 https://github.com/yanlingLabs/norma

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for norma CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/yanlinglabs/norma/claude-md.svg)](https://agentmods.dev/instructions/yanlinglabs/norma/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/yanlinglabs/norma/claude-md"><img src="https://agentmods.dev/badge/instructions/yanlinglabs/norma/claude-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 3,053 This file is loaded in full into every session.
When invoked 3,053 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03053 $0.03053
Opus 5 $0.01527 $0.01527
Sonnet 5 $0.00611 $0.00611
Haiku 4.5 $0.00305 $0.00305

Measured 4d ago against content hash 518dda1ca130, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

norma CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 117 lines

How it starts

The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

What this is

Norma is a macOS-native AI assistant: a TypeScript/Bun daemon (norma-core) that runs the agent loop, plus a native Swift menu-bar app that gives it a face. They talk JSON-RPC 2.0 over NDJSON on a Unix socket (~/.norma/run/core.sock). The daemon is the single source of truth; every client (CLI, app) is a view over its event stream.

Commands

bun install                          # install everything (bun is the runtime; pnpm workspaces orchestrate)

# Tests
pnpm test                            # all workspaces, serially
cd packages/core && bun test         # one package
bun test path/to/file.test.ts        # one file (path substring match)
bun test -t "test name"              # one test by name

# Protocol codegen — REQUIRED after changing packages/protocol/src (events/methods)
pnpm protocol:generate               # regenerates JSON schema + Swift round-trip fixtures

# Workflows e2e — proves the sandboxed runtime on the REAL compiled artifact (dist/norma-core)
bun run verify:workflow

# Swift
cd apple/NormaProtocol && swift test # protocol mirror round-trip tests
cd apple/NormaKit && swift test      # daemon client library
cd apple/Norma && xcodegen generate && \
  xcodebuild -project Norma.xcodeproj -scheme Norma -destination 'platform=macOS' build

# Run the daemon + CLI in dev
cd packages/cli
bun src/main.ts daemon run           # headless daemon
bun src/main.ts -p "hello"           # one-shot prompt (separate terminal)
bun src/main.ts                      # interactive TUI (Ink)

# Dev profile: the Debug app is "Norma Dev" (com.norma.app.dev) on ~/.norma-dev, keychain
# com.norma.core.dev; the global `norma-dev` command (installed by the dev app's menu) is an
# env-setting bun wrapper. The distribution app owns `norma` (symlink installed from the app /
# brew) on ~/.norma, keychain com.norma.core. Explicit NORMA_HOME always wins over both defaults.
# TWO TRAPS: (1) plain `norma` is the DIST CLI — with a dead socket it AUTO-LAUNCHES the dist app
# (`open -g -b com.norma.app`), so never use it for dev/test work: use `norma-dev`, or a temp
# NORMA_HOME with a manually-spawned `daemon run`. (2) Debug builds do NOT embed norma-core —
# "Norma Dev" cannot self-spawn a daemon; start the dev daemon below FIRST or the orb shows
# disconnected.
NORMA_HOME=~/.norma-dev NORMA_PROFILE=dev bun src/main.ts daemon run   # dev daemon (or: norma-dev daemon run)

# Versioning — never edit versions by hand; VERSION file (#.#.### format) is canonical
bun run version:bump                 # +0.0.001 (also --minor / --major)
bun run version:sync                 # restamp package.jsons/plists from VERSION

# Release (one command → signed, notarized, stapled zip+DMG+appcast+cask+gh release)
bun run scripts/release.ts --dry-run --no-bump   # full rehearsal, never publishes
bun run scripts/release.ts                       # real release (bumps version first)

Read the full file on GitHub · 117 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 117 lines · 3,053 tokens per session scan A 518dda1ca130

Subscribe to this mod's changes

norma CLAUDE.md is an instructions file published in the GitHub repository yanlingLabs/norma (2 stars, last pushed 7d ago), licensed Apache-2.0. It adds 3,053 tokens to every session, about $0.0153 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.