Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/griddynamics/rosetta/arrange-workspace-flow-reference-source-codegit clone --depth 1 https://github.com/griddynamics/rosettaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00020 | $0.00583 |
| Opus 5 | $0.00010 | $0.00292 |
| Sonnet 5 | $0.00004 | $0.00117 |
| Haiku 4.5 | $0.00002 | $0.00058 |
Grade A, and why
arrange-workspace-flow-reference-source-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
<arrange_workspace_reference_source_code>
<description_and_purpose>
Onboard read-only reference code the agent cannot otherwise see into refsrc/, documented in refsrc/INDEX.md.
</description_and_purpose>
<phase_steps>
- Identify existing reference source code
- Validate it is defined correctly, fix gaps
- Ask user for additional reference source code
- Validate and finalize what user provides </phase_steps>
<identify_existing step="2.1">
- Read
docs/ARCHITECTURE.md/docs/CONTEXT.mdfor mentions of external/reference code, if they already exist. - List existing
refsrc/*folders and existingrefsrc/INDEX.mdentries. </identify_existing>
<validate_existing step="2.2">
- Confirm root
.gitignorehas these exceptions; add any missing:
agents/TEMP/
refsrc/
!refsrc/INDEX.md
- Confirm every
refsrc/*folder has a matchingrefsrc/INDEX.mdheader; add missing entries. - Flag any
refsrc/INDEX.mdentry with no matching folder. </validate_existing>
<ask_for_reference_code step="2.3" type="HITL">
- Tell the user, briefly: the agent can't see code outside this repo — reference code (backend for a frontend repo, corporate/private libraries, a recently-changed public framework) lets it read without writing to it.
- Ask if there is reference code to add; if not, record no-op and stop.
- If yes, ask repo URL/path per codebase; guide: clone read-only into
refsrc/<name>. </ask_for_reference_code>
<review_reference step="2.4">
- Confirm each newly cloned codebase sits under
refsrc/<name>and stays read-only. - Re-apply
validate_existingchecks (gitignore +refsrc/INDEX.md) for the new entries. </review_reference>
<validation_checklist>
.gitignorecarries all three refsrc exceptions.- Every
refsrc/*folder has arefsrc/INDEX.mdentry, and vice versa. - User was asked about additional reference code. </validation_checklist>
</arrange_workspace_reference_source_code>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 62 lines · 20 tokens per session scan A 542994b2fd31
arrange-workspace-flow-reference-source-code is a command published in the GitHub repository griddynamics/rosetta (342 stars, last pushed today), licensed Apache-2.0. It adds 20 tokens to every session and 583 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
full-review-gate
Perform a comprehensive repository code review in an isolated worktree. Fix P0/P1 findings and ship them as a PR targeting the current branch.
implement-fastapi-routes
The file docstring contains a description of the FastAPI routes we need to implement. Implement these routes.
OPSX: Propose
Propose a new change - create it and generate all artifacts in one step.
deploy-setup
Wire CI + secrets for a fresh storefront. Run once after /init-store before the first push to main.
init-store
Clone the canonical Hydrogen starter, brand it, pin @commerce-atoms/agents, and create the first commit.
deploy-check
Pre-flight verification before pushing to main. Reproduces the CI gates locally so the push doesn't fail in production.