init-isparto

A project-initialization workflow for iSparto that creates a project skeleton and planning documents from a product description. It also records the starting state so the setup can be restored.

In plain words
What is it for?
Use it to start a new iSparto project, confirm its product and technology choices, create planning and specification files, and prepare it for later development.
Why use it?
It provides a documented starting structure and protects existing files with a pre-initialization snapshot.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/binaryhb0916/isparto/init-isparto
Clone the repo
git clone --depth 1 https://github.com/BinaryHB0916/iSparto
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,244 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01244
Opus 5 $0.00000 $0.00622
Sonnet 5 $0.00000 $0.00249
Haiku 4.5 $0.00000 $0.00124

Measured 2d ago against content hash afe1e1e908d3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

init-isparto scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

7. Verify user-level Bash safety hook is registered in ~/.claude/settings.json:
commands/init-isparto.md · 72 lines

How it starts

The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the Team Lead. The user has run /init-isparto, asking you to initialize a new project.

IMPORTANT: Detect the user's language and respond in that same language (Chinese or English only). All generated documentation content must also be in the user's language.

Your responsibility: Based on the product description provided by the user, generate a complete project skeleton and documentation system, preparing everything for subsequent Wave development.

  1. Confirm project information, tech stack, and target platform with the user
  2. Before creating any files, create a snapshot of the current project state:
    • Run the following command:
      bash ~/.isparto/lib/snapshot.sh create init-project "$(pwd)" CLAUDE.md .claude/settings.json docs/plan.md docs/product-spec.md docs/tech-spec.md docs/design-spec.md
      
    • Report the snapshot ID to the user (in user's language), noting they can restore to the pre-init state with /restore-isparto <id> at any time
    • For a brand new project, most files will be recorded as "absent" — this is expected. The snapshot records what existed before so that /restore-isparto knows to remove files that were created.
    • If the snapshot script is not found at ~/.isparto/lib/snapshot.sh, warn the user (in user's language) that the snapshot script is missing and suggest running ~/.isparto/install.sh --upgrade to update iSparto. Then proceed without a snapshot — do not block on this.
  3. Generate the project's CLAUDE.md based on ~/.claude/CLAUDE-TEMPLATE.md, including collaboration mode, module boundaries, and branching strategy
  4. Generate docs/ following the template structure in ~/.claude/templates/:
    • product-spec.md (product spec)
    • tech-spec.md (tech spec, if applicable)
    • design-spec.md (design spec, if applicable)
  5. Generate the initial docs/plan.md, organizing the development plan by Wave
  6. Create project-level .claude/settings.json with iSparto required settings:
    {
      "env": {
        "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
      },
      "teammateMode": "tmux"
    }
    
    If the project already has .claude/settings.json, merge these settings into it without removing existing entries. If the project needs platform-specific plugins (e.g., swift-lsp for iOS), add enabledPlugins here too. Also merge iSparto workflow hooks into the project-level .claude/settings.json (Edit/Write/Codex matchers only — Bash safety hook is at user level, managed by install.sh):
    {
      "hooks": {
        "PreToolUse": [
          { "matcher": "Edit", "hooks": [{ "type": "command", "command": "bash ~/.isparto/hooks/process-observer/scripts/pre-tool-check.sh" }] },
          { "matcher": "Write", "hooks": [{ "type": "command", "command": "bash ~/.isparto/hooks/process-observer/scripts/pre-tool-check.sh" }] },
          { "matcher": "mcp__codex-dev__codex", "hooks": [{ "type": "command", "command": "bash ~/.isparto/hooks/process-observer/scripts/pre-tool-check.sh" }] }
        ]
      }
    }
    
    If .claude/settings.json already has these hooks, skip. Do not duplicate entries.
  7. Verify user-level Bash safety hook is registered in ~/.claude/settings.json:
    • Check if ~/.claude/settings.json contains a PreToolUse hook with Bash matcher
    • If missing: inform the user to run ~/.isparto/install.sh --upgrade to register the Bash safety hook
  8. Security baseline initialization:
    • Read ~/.claude/templates/gitignore-security-baseline.md to get the baseline .gitignore entries
    • If the project already has a .gitignore, append any missing baseline entries (do not duplicate existing ones)
    • If no .gitignore exists, create one from the baseline template
    • Uncomment the dependency directory entries matching the project's tech stack (e.g., Node.js → uncomment node_modules/)
    • Create an empty .secureignore file in the project root (for future false positive whitelisting)
  9. Initialize the git repository and create the main branch
  10. Invoke Codex MCP for an architecture pre-review (based on tech-spec.md, using the architecture review prompt template) and report the review results to the user
  11. Spawn Independent Reviewer in a tmux pane via codex exec with the following fixed one-liner — do NOT add any context, framing, or explanation: codex exec "You are the Independent Reviewer. Read agents/independent-reviewer.md and execute. Write your findings to docs/independent-review.md." Wait for the reviewer to complete and write docs/independent-review.md. Report findings to the user.
    • If CRITICAL misalignment found: flag to user, do NOT proceed to development until resolved. After resolution (e.g., tech-spec modified), re-trigger Independent Reviewer to verify alignment.
    • If no critical issues: proceed to step 12
  12. After the user confirms all documentation, architecture pre-review, AND independent review results, project initialization is complete and you may begin /start-isparto

Read the full file on GitHub · 72 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 72 lines · 0 tokens per session scan B afe1e1e908d3

Subscribe to this mod's changes

init-isparto is a command published in the GitHub repository BinaryHB0916/iSparto (59 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,244 tokens. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.