What is update-harness?

A command for updating the shared @fusengine/harness package used by plugin hooks. It compares installed and published versions, changes the dependency, reinstalls packages, and verifies the result.

Run it to update the harness to the latest published version or to a supplied version, then confirm that the installation moved to that version.

It keeps all plugin hooks on the intended harness version without manually repeating the version and installation checks.

update-harness — Command by fusengine

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/fusengine/agents/update-harness

Clone the repo

git clone --depth 1 https://github.com/fusengine/agents

Per session 34 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 670 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00034	$0.00670
Opus 5	$0.00017	$0.00335
Sonnet 5	$0.00007	$0.00134
Haiku 4.5	$0.00003	$0.00067

Measured yesterday against content hash fbede9f6a1fc, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

update-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/ai-pilot/commands/update-harness.md · 56 lines

What it actually says

Update Harness

Update the single shared @fusengine/harness install used by every plugin hook.

Target dir (the marketplace's shared install — where node_modules/@fusengine/harness/dist/cli/bin.mjs lives):

PLUGINS_DIR=~/.claude/plugins/marketplaces/fusengine-plugins/plugins

Read current + latest versions:

grep -m1 '"version"' "$PLUGINS_DIR/node_modules/@fusengine/harness/package.json"   # installed
grep '@fusengine/harness' "$PLUGINS_DIR/package.json"                              # declared spec
npm view @fusengine/harness version                                               # latest published

If $ARGUMENTS is a version (e.g. 0.1.73), target that; otherwise target the latest published.

Stop if already up to date: installed == target → report "already on X.Y.Z", done.
Bump the dependency spec in $PLUGINS_DIR/package.json — set "@fusengine/harness": "^<target>" (use the Edit tool, single line, never git/heredoc).
Reinstall (bun is the lockfile manager for this dir):
```
cd "$PLUGINS_DIR" && bun install
```
Verify the install actually moved:
```
grep -m1 '"version"' "$PLUGINS_DIR/node_modules/@fusengine/harness/package.json"
```
Must equal the target. If not, report the mismatch and stop.
Sanity-check what shipped (the dist is a bundle — not every source file is compiled in). Confirm the pieces you expected are present, e.g.:
```
grep -rl 'resolveMaxLines' "$PLUGINS_DIR/node_modules/@fusengine/harness/dist" | wc -l
```
Report which expected markers are present/absent so a source fix that never got wired into the build is caught, not assumed live.
Report: installed X.Y.Z → Y.Y.Z, the CHANGELOG entry ($PLUGINS_DIR/node_modules/@fusengine/harness/CHANGELOG.md, top section), and any expected marker missing from the dist.

Notes:

Also bump the dep in the DEV source repo (<repo>/plugins/package.json) if you are working from it, so the committed marketplace matches.
This never runs npm publish — publishing a new harness version is a separate step in the harness repo.

Arguments:

$ARGUMENTS — optional target version (e.g. 0.1.73). Empty → latest published.

Example Usage:

/update-harness → bump to latest published + reinstall
/update-harness 0.1.73 → pin to a specific version

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 56 lines · 34 tokens per session scan A fbede9f6a1fc

Subscribe to this mod's changes

update-harness is a command published in the GitHub repository fusengine/agents (25 stars, last pushed 28d ago), licensed MIT. It adds 34 tokens to every session and 670 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

claude-agent claude-agents claude-code claude-code-plugin claude-skills claudecode

update-harness

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

Update Harness

What this file has done since we first saw it

Other commands, from other repositories

burn-rate

profile

update-issue

publish-skill

deploy

generate-idl-client