What is browser-spa-framework?

A set of architecture rules and conventions for Echo, a browser-based single-page application with a Go server, a Vite-built TypeScript and JavaScript front end, JSON APIs, and WebSockets.

Use it when adding or modifying Echo's server, browser interface, WebSocket tool loop, settings, workspaces, shared data file, tests, or media-preview features.

It gives agents the current structure and persistence rules for the application, including where shared data belongs and which older code should not be reused. This reduces changes that conflict with the project's architecture.

browser-spa-framework — Skill by BrentFarris

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/brentfarris/echo/browser-spa-framework

Any agent

npx skills add BrentFarris/echo --skill browser-spa-framework

Clone the repo

git clone --depth 1 https://github.com/BrentFarris/echo

Made for: Claude Code, Codex.

Per session 91 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,265 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00091	$0.03265
Opus 5	$0.00046	$0.01632
Sonnet 5	$0.00018	$0.00653
Haiku 4.5	$0.00009	$0.00327

Measured 2d ago against content hash cb604feaf9da, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

browser-spa-framework scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Manual smoke: `go run .` then `curl http://localhost:3740/api/health`, `/` (index), `/some/route` (SPA fallback), `GET/PUT /api/settings`, `GET/POST /api/workspaces`, `GET /api/workspaces/{id}/fs/media?rootId=&path=img

.echo/skills/browser-spa-framework/SKILL.md · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Echo Browser SPA Framework

Echo is now a browser-based app (not Wails). A Go server hosts a single-page application and a JSON/WebSocket API. Old Wails code lives in echo/OLD and should not be referenced for new work. Parity ports from the Wails branch (origin/jjtw87) are surgical: copy individual files/functions, never merge the branches (they diverge heavily — services-layer vs server-package architecture).

Shared app data file (echo.json) — settings + workspaces

internal/appdata owns the single Echo app data file at os.UserConfigDir()/Echo/echo.json (DefaultStorePath()). The file is one JSON document: {"settings": <raw JSON>, "workspaces": [...]}.
appdata.File keeps Settings as json.RawMessage so the package stays decoupled from the settings schema. appdata.Store.Load() migrates a legacy bare-settings file (no "settings" key) by treating the whole document as settings. Save() writes to a .tmp then renames into place.
Both the settings store and the workspace manager share this one file so they never clobber each other. When adding a new persisted top-level concern, extend appdata.File rather than creating a separate file.
Tests must use NewWithSettingsPath(addr, webDir, tempPath) with an isolated temp path so they never touch the real echo.json.

Workspace registration (internal/workspaces)

workspaces.Manager keeps the workspace ID and absolute main-folder locator in shared appdata, while .echo/workspace.json is authoritative for the workspace name, folders, and settings. Create(...) writes portable config paths and registers an ID-preserving locator in appdata. Icon.Data is []byte, so the frontend must send image bytes as a base64 string. API endpoints in internal/server/workspaces_api.go all use the standard JSON envelope.

Backend (Go, stdlib net/http)

Entry point: echo/main.go. Default port 3740 (-port flag). Production binaries embed web/dist via //go:embed web/dist; after frontend changes run npm run build in web/ so the embedded bundle picks them up.
internal/server package: server.go (Server, New, routes, ListenAndServe/Shutdown, Go 1.22 method-pattern ServeMux), api.go (writeJSON/writeData/writeError), ws.go (WebSocket Hub).
JSON envelope: every endpoint returns {"ok":true,"data":...} or {"ok":false,"error":"..."}. New endpoints must follow this. Raw binary streams (e.g. /fs/media) bypass the envelope and set Content-Type directly.

Read the full file on GitHub · 93 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 93 lines · 91 tokens per session scan A cb604feaf9da

Subscribe to this mod's changes

browser-spa-framework is a skill published in the GitHub repository BrentFarris/echo (11 stars, last pushed 3d ago), licensed MIT. It adds 91 tokens to every session and 3,265 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Frontend ai ai-agents ai-assistant ai-harness coding programming

claude_code_delegation

Delegate coding, review, and refactor tasks to Claude Code CLI through Row-Bot's approval-gated shell workflow.

siddsachar/row-bot · 31 tokens

developer_coding

Structured workflow for implementing code changes in Developer Studio.

siddsachar/row-bot · 14 tokens

code-runner

Execute Python code, Shell commands, and pytest tests in a sandboxed environment. Returns structured results with stdout, stderr, exitcode, and timing. Use when writing/testing/debugging code, running scripts, or validating code snippets. Supports --lang python/shell/test, --timeout, --workdir.

xyva-yuangui/XyvaClaw · 65 tokens

browser-spa-framework