Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/geckse/markdown-vdb/publish-appgit clone --depth 1 https://github.com/geckse/markdown-vdbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/geckse/markdown-vdb/publish-app)<a href="https://agentmods.dev/commands/geckse/markdown-vdb/publish-app"><img src="https://agentmods.dev/badge/commands/geckse/markdown-vdb/publish-app.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00619 |
| Opus 5 | $0.00000 | $0.00309 |
| Sonnet 5 | $0.00000 | $0.00124 |
| Haiku 4.5 | $0.00000 | $0.00062 |
Grade A, and why
publish-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Publish a new version of the Electron desktop app (Tesseract) to GitHub Releases.
The app lives in the app/ git submodule, which is its OWN repository: github.com/geckse/tesseract-md-app. Its release workflow (app/.github/workflows/build-app.yml) triggers on v* tags pushed to THAT repo. Tags in the parent markdown-vdb repo (including the old app-v* scheme) do NOT trigger it.
Steps:
- Preflight — the app working tree must be clean:
git -C app status --porcelainmust produce EMPTY output. If it prints anything, ABORT and tell the user to commit or stash their in-progress app work first.git -C app branch --show-currentmust printmain(submodules are often in detached-HEAD state; committing there would strand the release commit). If not onmain, ABORT and ask the user.
- Read the current version from
app/package.jsonand ask the user what the new version should be (suggest patch, minor, major bumps). - Update the
versionfield inapp/package.json. - Commit INSIDE the app submodule:
git -C app add package.jsongit -C app commit -m "chore: bump version to <version>"
- Tag
v<version>in the app repo and push branch + tag to the app's origin (github.com/geckse/tesseract-md-app):git -C app tag v<version>git -C app push origin maingit -C app push origin v<version>That repo's GitHub Actions builds mac (signed + notarized), win (unsigned for beta), and linux, and publishes a DRAFT GitHub release.
- Wait for all three matrix jobs to succeed (watch with
gh run list -R geckse/tesseract-md-app --workflow build-app.yml), then publish the draft:gh release edit v<version> -R geckse/tesseract-md-app --draft=false --generate-notes
- In the parent markdown-vdb repo, record the new submodule commit:
git add appgit commit -m "chore: bump app submodule to v<version>"git push
Notes:
- The tag MUST match the
v*pattern and MUST be pushed to the APP repo (geckse/tesseract-md-app) to trigger the CI workflow. Do not tag the parent repo. - macOS signing + notarization use the
CSC_LINK,CSC_KEY_PASSWORD,APPLE_ID,APPLE_APP_SPECIFIC_PASSWORD,APPLE_TEAM_IDsecrets configured in geckse/tesseract-md-app (mac job only). Windows ships unsigned for beta. - Do NOT push without user confirmation
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 31 lines · 0 tokens per session scan A 6ce40d1f861f
publish-app is a command published in the GitHub repository geckse/markdown-vdb (23 stars, last pushed 20d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 619 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
beans-release-notes
Generate release notes from commits since the last version tag and write them to .docs.local/RELEASE.md.
publish
Publish a new version of the notebookmd package. Follow these steps exactly.
go
Implement the agreed spec, ship to main, and deploy to the cluster — the dark-factory one-keystroke. Run from inside a feature worktree.
land
End-of-session wrap-up — commit WIP, sync onto main, gate against the worktree, then squash-merge to main. Runs the deterministic scripts/ship. Run from inside a feature worktree.
release
Perform a new release with version bump, changelog update, and GitHub release.
issue-amend
Re-snapshot the active issue's scope from the spec, clear verified and reviewed receipts, and record the change as a permanent amendment.