Borrowing it
Nothing to install: this file belongs to clay-good/OpenLore. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/clay-good/OpenLore/main/.claude/commands/first-run-hardening.mdgit clone --depth 1 https://github.com/clay-good/OpenLoreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/clay-good/openlore/first-run-hardening)<a href="https://agentmods.dev/commands/clay-good/openlore/first-run-hardening"><img src="https://agentmods.dev/badge/commands/clay-good/openlore/first-run-hardening/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/clay-good/openlore/first-run-hardening"><img src="https://agentmods.dev/badge/commands/clay-good/openlore/first-run-hardening.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.01323 |
| Opus 5 | $0.00024 | $0.00661 |
| Sonnet 5 | $0.00010 | $0.00265 |
| Haiku 4.5 | $0.00005 | $0.00132 |
Grade A, and why
first-run-hardening scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenLore first-run hardening pass
You are working in the OpenLore repo, a published npm CLI (openlore) that gives coding
agents persistent architectural memory via static analysis + an MCP server. Your job: find
and fix the bugs that break a NEW USER's first-run experience — the way earlier passes found
"unknown command 'orient'", "--no-embed kills BM25", "watcher EMFILE on target/", and
"install never builds the index".
If the user named a target repo or a specific area in their message ($ARGUMENTS), focus there; otherwise pick a clean repo as described below.
Method — dogfood, don't just unit-test
-
BUILD FIRST so you test current code, not the published version:
npm run build→ drivenode dist/cli/index.js, never bareopenlore/npx openlore(those resolve the OLD published version). When comparing to published behavior, do it explicitly withnpx --yes openlore@latestand label it. -
Pick a CLEAN sibling repo under the parent of this repo that does NOT already have openlore (check: no
.openlore, noopenspec/, no OpenLore block inCLAUDE.md). Prefer variety across runs — a Rust repo (hugetarget/), a big monorepo, a Python repo, a repo with a pre-existing.claude/settings.json. proxilion (Rust) and vaulytica (TS) are known-good. -
Run the REAL first-run flow as a user would, end to end, checking exit codes AND actual output of each step: openlore install # the one-command path
then simulate the first agent session: run the SessionStart hook command verbatim
from .claude/settings.json, plus a real
orient --taskqueryAlso exercise: init → analyze → analyze --no-embed → analyze --force → orient (no task / with task / bad --limit) → install --no-analyze → install --dry-run → install --uninstall → mcp server over stdio (initialize → tools/call orient).
-
Stress the edges that break in the field, not just happy paths:
- Large/non-TS repos (build dirs: target/, node_modules/, dist/, .venv/, vendor/) → EMFILE, ENOSPC, multi-minute hangs, watching the wrong tree.
--jsonoutput must be PURE parseable JSON on stdout; all diagnostics/logs go to stderr. (Pipe2>/dev/nulland JSON.parse it.)- Idempotency / re-runs: running install or analyze twice must be a clean no-op, not a duplicate or a clobber.
- Pre-existing user files (.claude/settings.json, CLAUDE.md, .gitignore): MERGE, never clobber. Verify with a repo that already has them.
- process.cwd() vs explicit-dir handling; commander singletons leaking option state between parseAsync calls in tests.
- Wrapper/skill paths (orient.sh, orient.ps1, orient-via-mcp.mjs) and graceful degradation against OLDER openlore versions that lack new flags.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 85 lines · 49 tokens per session scan A 5a616b310bf1
first-run-hardening is a command published in the GitHub repository clay-good/OpenLore (301 stars, last pushed yesterday), licensed MIT. It adds 49 tokens to every session and 1,323 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
distill
Creates E2E acceptance tests in Given-When-Then format from requirements and architecture. Use when preparing executable specifications before implementation.
ui-aqa-flow-test-implementation
Phase 6 Test Implementation of ui-aqa-flow.
web-checklist
A checklist command for testing a website after a Git merge. It records checklist items in a file so progress can be viewed and individual checks can be marked complete.
ui-aqa-flow-test-report-analysis
Phase 7 Test Report Analysis of ui-aqa-flow.
ui-aqa-flow-code-analysis
Phase 3 Code Analysis of ui-aqa-flow.
ui-aqa-flow-selector-implementation
Phase 5 Selector Implementation of ui-aqa-flow.