Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/ghosteken/agent-harness/buildgit clone --depth 1 https://github.com/Ghosteken/agent-harnessWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.01036 |
| Opus 5 | $0.00014 | $0.00518 |
| Sonnet 5 | $0.00006 | $0.00207 |
| Haiku 4.5 | $0.00003 | $0.00104 |
Grade A, and why
build scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Invoke the agent-harness:incremental-implementation and agent-harness:test-driven-development skills.
Modes
/build— implement the next pending task, then stop (careful, one slice at a time)./build auto— generate the plan if needed, get a single approval, then implement every task without stopping between them.
$ARGUMENTS selects the mode. Treat auto (canonical) or all as autonomous mode; anything else (or empty) is the default single-task mode. Note: autonomous mode is not faster per task — it runs the same test-driven loop — it only removes the human stepping between tasks.
Never run git commit (or git add followed by a commit) yourself, in either mode, unless the user explicitly asks you to commit in that message. Stage nothing implicitly and commit nothing implicitly — draft a commit message and tell the user the change is ready, then leave the actual commit to them.
Default: one task
Pick the next pending task from the plan. Then:
- Read the task's acceptance criteria
- Load relevant context (existing code, patterns, types)
- Write a failing test for the expected behavior (RED)
- Implement the minimum code to pass the test (GREEN)
- Run the full test suite to check for regressions
- Run the build to verify compilation
- Draft a commit message and tell the user the change is ready to commit — do not run
git commityourself - Mark the task complete and stop
Autonomous: the whole plan (/build auto)
Use this once a spec exists and you want to collapse plan + build into one run. It removes the manual stepping between tasks — not the verification, and not the no-auto-commit rule. Every task still earns a passing test; none earns an agent-run commit.
- Require a spec. Look only for a spec at a known path:
docs/specs/<feature-slug>/SPEC.md, or (legacy)SPEC.mdat the repo root. A README or arbitrary doc does not count. If none exists, stop and tell the user to run/specfirst — do not invent requirements. - Establish a clean baseline. Run
git status --porcelain. If there are uncommitted changes outside the expected planning artifacts (docs/specs/**,docs/plans/*), stop and ask the user how to handle them — do not commit, stash, or discard anything yourself. This task-boundary check protects the rollback guarantee below from absorbing unrelated local work. - Plan if needed. If there is no
docs/plans/<feature-slug>-plan.md, invoke agent-harness:planning-and-task-breakdown to generate one. - Single checkpoint. Present the full plan and wait for an unambiguous affirmative (e.g. "approve", "go", "yes"). Treat hedged responses ("looks reasonable", "I guess") as not approved. This is the only human gate — after approval, run autonomously through implementation (but still never auto-commit).
- Execute every task in dependency order. Use each task's declared dependencies; if they aren't explicit, execute in the order the plan lists them. For each task, run the full default loop above (RED → GREEN → regression → build → draft commit message → mark complete). Since nothing gets committed automatically, the per-task "clean rollback" property now lives in the task-status log and diffs you present, not in git history — call this out to the user, and suggest they commit after each task (or batch) themselves if they want that guarantee restored as real git history.
- Stop and ask the user (do not push through) when:
- a test can't be made to pass or the build breaks without an obvious fix → follow agent-harness:debugging-and-error-recovery
- the spec is ambiguous, or a task needs a decision the spec doesn't cover
- a task is high-risk or irreversible — auth/permission changes, destructive data migrations, payments, deletions, deploys, anything touching secrets, or anything that would be hard to undo without a commit history to revert to → follow agent-harness:doubt-driven-development and get explicit sign-off before continuing
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 47 lines · 28 tokens per session scan A f60dcdae6d1a
build is a command published in the GitHub repository Ghosteken/agent-harness (2 stars, last pushed 16d ago), licensed MIT. It adds 28 tokens to every session and 1,036 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
cost-tracker
Track session costs, understand token spend, and get optimization tips.
journey-audit
Outside-in product audit as a deep session — 7 read-only roles check what the site promises against what the code does, what a user experiences, what arrives by mail, and what the data says is used. Writes a dossier; needs a per-repo journey-manifest.
dispatcher
Pick the next-best repo to work on across the portfolio — rank free repos, recommend one, claim its lease atomically, and route to the entry command.
mach12:gh-pr-read
Read a GitHub pull request's title, body, and all top-level PR conversation comments; optionally locate an HTML-marker comment.
triage-issues
Launch the Issue Triage Agent (Haiku) to categorize and prioritize GitHub issues.
qa
Smoke or browser-walk a running app. Report only. Do not implement. Do not merge.