Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/modelstudioai/cli/lint-toolchaingit clone --depth 1 https://github.com/modelstudioai/cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00905 |
| Opus 5 | $0.00000 | $0.00452 |
| Sonnet 5 | $0.00000 | $0.00181 |
| Haiku 4.5 | $0.00000 | $0.00090 |
Grade A, and why
lint-toolchain scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
工具链调整
触发条件
- 升级 Vite+ / TypeScript / Node 版本
- 调整
vite.config.ts(根 / 各包) - 改 lint 规则(Oxlint / Oxfmt / typescript-eslint)
- 升级或替换依赖
- 修改
.vite-hooks/或 git hooks
必查清单
A. 版本一致性
- 发布包（
cli等）的engines.node与 README 的 Node.js 徽章一致；根/e2e 开发要求（>=22.12）与 CONTRIBUTING 一致 -
pnpm-lock.yaml同步生成(运行pnpm install) - 各源码包
tsconfig.json(根 + core + runtime + commands + cli + kscli)的 target / module 设置一致
B. lint / format 规则改动
- 全仓跑
vp check --fix,看是否产生大量自动 reformat - 如果产生 mass diff,单独提一个 commit(代码语义改动和 lint reformat 不要混)
- 已有 warning 的处理:
- 如果新规则消除了某些旧 warning,确认是否合理
- 如果新规则产生了新 warning,评估是否要修
C. 构建配置
-
packages/*/vite.config.ts的 entry / dts / exports 设置符合包类型:- library 包(core/runtime/commands):本地
exports默认指向src/index.ts;publishConfig.exports覆盖发布入口为dist/index.mjs;dts 产物正常生成 - binary 包(cli/kscli):entry 指向
src/main.ts,有 shebang,exports: true
- library 包(core/runtime/commands):本地
- cli / kscli 的 bundle 必须把 workspace 包(
bailian-cli-core/bailian-cli-runtime/bailian-cli-commands)当 external(不内联),确认 dist 中仍是 package import - cli / kscli 的 binary bundle 第一行必须有
#!/usr/bin/env nodeshebang
D. 依赖升级
- 检查 workspace 内部依赖在
dependencies里仍是"workspace:*"(不要手改成实际版本号;发布时由 pack/publish 流程解析) - 升级后跑
vp check && vp test - 升级
@types/node时注意 Node API 变化(如 fs.existsSync 行为)
E. git hooks / pre-commit
-
.vite-hooks/pre-commit改动后,pnpm install重新软链(走prepare: vp config) - 增加 hook 时,确认在干净 clone 后能自动激活
- pre-commit 会跑
pnpm run sync:skill-assets(generate:reference含格式化 +sync:skill-version,直接读源码、无需先 build)并git addskill 资产,最后vp staged
F. CI / 发版工具
-
tools/release/中如有版本/规则相关的硬编码,同步更新 - 比如
secretPatterns添加新的敏感值识别
完成后自查
# 完整冒烟
pnpm install --frozen-lockfile
vp check
vp test
node tools/release/check.mjs
常见漏点
- ✗ 升级 Node engines 但忘了 README 徽章
- ✗ 改 lint 规则后没全仓
--fix,新人 PR 报红一片 - ✗ 改 cli/kscli 的 vite config 把 core/runtime/commands 不小心打成 inline,bundle 体积暴涨
- ✗ Oxlint 配置改了但 IDE 缓存还是旧的(IDE 可能要重启 ts server)
- ✗ 升级依赖一并升 lockfile,改动量大但没拆 commit
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 69 lines · 0 tokens per session scan A bcb7b2cb2dd2
lint-toolchain is an agent published in the GitHub repository modelstudioai/cli (320 stars, last pushed 4d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 905 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
index
Browse built-in Agent Framework capabilities for multimodal input, tools, retrieval, evaluation, security, and autonomous execution.
mlops-engineer
ML operations agent for experiment tracking, model registry, feature stores, ML pipelines, model serving, drift monitoring, and AIOps.
loom-senior-software-engineer
Use PROACTIVELY for architecture design, complex debugging, design patterns, code review, test strategy, data modeling, ML system design, UX strategy, documentation architecture, and strategic technical decisions across all domains.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
loom-code-reviewer
Read-only code review agent for comprehensive review of code quality, security, architecture, and best practices. Cannot modify files.
integrity-check
Detect adversarial content in .rune/ files — prompt injection, memory poisoning, identity spoofing, zero-width Unicode. Verdict: CLEAN/SUSPICIOUS/TAINTED.