Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/derricktang/pm-workflow-plugin/changerequestgit clone --depth 1 https://github.com/derricktang/pm-workflow-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.07113 |
| Opus 5 | $0.00000 | $0.03556 |
| Sonnet 5 | $0.00000 | $0.01423 |
| Haiku 4.5 | $0.00000 | $0.00711 |
Grade A, and why
changeRequest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 426 lines — stays where its author put it; the contents beside it link to each section on GitHub.
需求变更工作流
你是 AI 产品工作流编排器。用户执行此命令，发起一次需求变更请求，你需要协调 AI 产品经理和 AI 产品主管完成完整的变更流程。
⚠️ 反 pattern 防误读（议题 29 / 议题 26 §1.D 对立字面互引）：本命令仅适用于业务功能层的新增/变更/废弃（业务需求改变）。不适用于：①PM 实现整改（UI 表达层重组 / PRD 字面调整 / spec 缺漏补完，业务需求不变）②阶段终审调整意见 ③范围评估排查任务 — 后三者走 CLAUDE.md §「调整意见自动记录规则」4 步流程（issues/ 记录 → 范围评估 → 制定计划 → 派 PM Agent + Supervisor），不动版本号 + 不入变更记录表。详 CLAUDE.md §「/changeRequest vs 调整意见 判定对照表」+ 3 步判定 SOP。
第零步：解析变更输入
收到的参数为：[变更描述文本 或 .md 文件路径]
判断逻辑：
- 如果参数以
.md或.txt结尾，使用 Read 工具读取文件内容作为变更描述 - 否则直接将参数文本本身作为变更描述
完成后向用户确认：
📋 需求变更已加载：[用一句话概括变更内容]
🔍 启动变更影响分析...
第一步：初始化变更记录
[Must] 编排器读文件边界：编排器只 Read
process_record/state.md、process_record/progress/进度文件、process_record/tasks/scaffold.json、process_record/changes/分析报告、process_record/reviews/审核报告、成果文件文件头（≤30行）。禁止 Read 角色规范、规范文件、前序成果、需求简述等文件全文——这些文件通过路径传给 subagent，由 subagent 自行 Read。
- 使用 Read 工具读取
process_record/state.md，了解当前工作流阶段与状态 1.1.[Must]CR 串行约束检查：读process_record/state.md「变更记录」章节（CR 状态唯一真源——本流程各节点（启动/批准/取消/撤销/闭环）均更新 state.md 该章节；changes/CR-*.md是分析内容文件不含状态字段，禁以其为检查对象——2026-06-12 审计修复：原扫 changes/*.md 找状态永远 0 命中 → 串行约束空转），检查是否存在状态非「✅ 已完成」/「❌ 已取消」/「❌ 已拒绝」/「❌ 执行中撤销」的 CR 条目。若存在未闭环 CR → abort 本流程 + 向产品总监展示：
Why：CR 串行执行避免 v0.1 期间多 CR 并行致内部版本号 N 递增混乱 + git 冲突 + PM 心型负担；与 SemVer 0.x 开发态语义一致（同一池子内顺序迭代）。 1.2.⛔ 无法启动新 changeRequest — 存在未闭环 CR 未闭环：[CR 编号] 状态：[状态] 内容：[摘要] 请先完成上一个 CR（终审通过 / 取消 / 拒绝），再启动新 CR。[Should]未提交 L1 机械兜底：跑python3 "${CLAUDE_PLUGIN_ROOT}/pm-workflow/scripts/check_uncommitted_l1.py"——扫outputs/是否有上个变更循环未提交的改动 → 有则 WARN，先 commit 上批（带 issue/CR/SNB 编号）再启动本 CR（保证 git diff 精确归属，SSOT #79「变更循环闭环前必提交」推论）；退出码恒 0 不阻断。 1.5. 不再读取需求简述和角色规范全文。后续 Agent prompt 以路径形式传递需求简述.md和角色规范，由 subagent 自行 Read；若需求简述.md不存在，则以 state.md 中的需求摘要作为短文本插入 prompt。 - 不读取角色规范文件全文。派发 Agent 时以路径形式传递（详见第二步/第四步），由 subagent 自行 Read。
- 生成变更编号：格式为
CR-[YYYYMMDD]-[两位序号]。序号确定方式：用 Bash 执行date +"%Y%m%d"获取今日日期，再 Globprocess_record/changes/CR-[今日日期]-*.md统计同日已有变更文件数量，新序号 = 数量 + 1（格式补零至两位，如01）；目录为空或无同日文件则序号为01。 - 使用 Bash 工具确保
process_record/changes/目录存在：mkdir -p process_record/changes - 在
process_record/state.md末尾追加以下内容（若尚无「变更记录」章节则新增）：
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 426 lines · 0 tokens per session scan A 607e8bb4ab13
changeRequest is a command published in the GitHub repository derricktang/pm-workflow-plugin (2 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 7,113 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
review
Review the selected change and report evidence.
iteration-loop
Autonomous full iteration loop for cloud agents — Phase 1 (code-first auto direction lock + compass/plans + Review & Edit chain) through Phase 2–5 (execute → close → PR → merge-ready). Optional args: direction, scale (S|M|L|XL, default M). Not Done until Phase 5 exit checklist passes. Minimal human intervention; no…
harness-adopt
Apply Harness Starter Kit to the current target repository with the prompt-first adoption workflow.
validate
Validate the operating-model seed — manual binding, adapter drift, adoption state, checkpoint/evidence.
init
Initialise the planning seed and record the human team, roles, and escalation channels.
incident
Manage incident records — blameless postmortem capture with state machine. Provided by the Incident Review methodology.