Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/peiiii/nextclaw/react-rendering-lifecycle-safetynpx skills add Peiiii/nextclaw --skill react-rendering-lifecycle-safetygit clone --depth 1 https://github.com/Peiiii/nextclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/peiiii/nextclaw/react-rendering-lifecycle-safety)<a href="https://agentmods.dev/skills/peiiii/nextclaw/react-rendering-lifecycle-safety"><img src="https://agentmods.dev/badge/skills/peiiii/nextclaw/react-rendering-lifecycle-safety.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00076 | $0.01628 |
| Opus 5 | $0.00038 | $0.00814 |
| Sonnet 5 | $0.00015 | $0.00326 |
| Haiku 4.5 | $0.00008 | $0.00163 |
Grade A, and why
react-rendering-lifecycle-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
React Rendering Lifecycle Safety
目标
React 数据更新不应自动等价为结构重建。除非产品明确要求重置,流式输出、查询刷新、回调换引用和状态切换都必须保留历史内容与状态型表面的元素身份。
核心模型:React 用 type + key + 父级位置 识别元素。三者任一发生变化,都可能卸载旧 subtree 并重新挂载;memo、useMemo 和 useCallback 不能改变这条身份规则。
强制合同
1. 组件类型必须稳定
- 会作为 JSX 类型、Markdown renderer、component map entry 或 render registry value 使用的组件,默认在模块级声明。
- 动态数据、文案和回调通过 props、Context 或稳定 owner 读取;不得通过重新创建组件类型传递动态值。
- 禁止在组件 render、带动态依赖的
useMemo/useCallback或普通 factory 中创建组件函数,再把它作为 JSX 类型或第三方 renderer 交给 React。 useMemo(() => ({ p: () => ... }), [callback])仍会在依赖变化时生成新的组件类型;它只缓存值,不提供组件身份合同。
2. key 和父级结构必须表达业务身份
key使用稳定业务 ID,不使用数组索引、时间戳、streaming 状态、加载阶段或每次 render 新生成的值。pending -> streaming -> final、查询刷新、排序反馈和局部内容追加,不得改变同一业务实体的 key。- 不要因为状态变化在互不相同的 wrapper / group / portal 结构之间搬运同一 subtree;确需改变父级结构时,先判断是否会重置内部状态。
3. 状态型表面是硬生命周期边界
- iframe、Panel App、editor、canvas、audio、video、WebGL、文件预览和持有浏览器 selection 的文本节点,默认必须保留 DOM 实例。
- 动态分组、折叠、消息聚合和流程摘要不能吞并或跨越这些边界。
- 只有明确的重置、关闭、切换实体或用户主动刷新才能 remount;必须用语义化 key 或显式 reset action 表达,并有测试证明。
4. 后台同步不得接管用户交互状态
- 用户未操作时,不得调用
focus()、改写 DOM selection、恢复旧焦点或关闭当前弹层。 - editor/store/query 的后台同步只更新其拥有的数据;浏览器
activeElement、文字选区和外部弹层不归输入 owner 自动接管。 - 不要在每个 Popover、搜索框或预览区保存/恢复焦点来掩盖上游违约;先修真正触发 focus、selection 或 remount 的 owner。
5. Editor 框架必须独占实时输入状态
- 集成 Lexical、ProseMirror 等 editor 时,先确认框架已拥有的
beforeinput、input、composition、selection 和平台兼容管线;业务层不得再次拦截同一原生事件并从外部快照重建文档。 - React/store 中的 draft 默认是发送、持久化或恢复投影,不是普通键入期间与 editor 并列的第二个可写文档 owner。
- 普通文字、IME 候选词替换、删除和换行优先走 editor 原生命令;只有明确 reset/restore/token 等程序化意图才能写回 editor,并用精确 update tag/source 区分,禁止用定时器或整帧布尔锁忽略 update。
- 若自定义原子节点删除,直接修改目标 editor node,不得先线性化全文再清空 root 重建 selection。
实现检查
修改 React 渲染链路前,逐项确认:
- 哪些 props、query wrapper、callbacks 会在流式或刷新期间换引用。
- 这些动态值是否参与创建组件类型、renderer map、key 或父级分组。
- 哪些 subtree 持有浏览器状态或第三方运行时状态,必须视为硬边界。
loading / pending / streaming / final / error是否只改变 props 和可见内容,而不替换同一实体的结构身份。- 是否存在因历史焦点问题留下的
onFocusOutside.preventDefault()、selection restore 或定时 focus 补丁;根因修复后应删除。 - editor 是否同时被原生事件、React handler 和外部 draft 回灌多路写入;若是,先收敛实时 owner,再讨论事件特判。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 90 lines · 76 tokens per session scan A cb644be9bafc
react-rendering-lifecycle-safety is a skill published in the GitHub repository Peiiii/nextclaw (253 stars, last pushed today), licensed MIT. It adds 76 tokens to every session and 1,628 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ha-skill-creator
Create, edit, improve, or audit Hope Agent skills. Use when the user wants to: (1) create a new skill from scratch, (2) edit or improve an existing skill, (3) review or clean up a SKILL.md file, (4) run evaluations to test skill effectiveness, (5) optimize skill descriptions for better trigger accuracy. Trigger…
ha-browser
Hope Agent browser automation — the standard status → tabs → snapshot → act loop, stale-ref recovery rules, and what to do when login / 2FA / captcha / camera-prompt / dialog blocks progress. Load this skill whenever you reach for the browser tool. Trigger on: user asks the agent to open / control / click / scrape /…
ha-logs
Self-service diagnostics — query Hope Agent's local SQLite databases (logs / sessions / background jobs) directly via the exec tool to investigate problems, analyze usage, and locate root causes. Trigger on: user reports something broken / failing / slow / stuck / not responding ('X 不工作', 'X 报错', 'X 卡住', '为什么 X 失败'…
ha-pet-import
Safely import, select, switch, or enable a compatible desktop pet in Hope Agent. Resolve packages from any origin, including local folders, zip archives, pet.json plus a sprite, PNG/WebP atlases, chat attachments, repository or cloud files, direct HTTPS artifact URLs, and download pages. Use whenever a user asks to…
china-translate
中英互译 + 本地化 - 技术翻译、UI本地化、文化适配、避免机翻腔.
email-draft
Use when the user asks to draft, polish, translate, or reply to an email. Produces a clean draft with subject line, greeting, body, and sign-off, plus a pre-send self-check.