harness-exec

harness-exec is a command for coding agents from hahaxiang27/FlowHarness. It costs 27 tokens per session (3,534 once invoked), scanned A, original, MIT.

A task-execution command that completes the next or a selected development task and runs two levels of checks. TDD means writing or using tests as part of development.

In plain words
What is it for?
Use it to implement a named task or the next unfinished task, follow the project’s development process, and record whether its checks pass.
Why use it?
It keeps each task grounded in the project files and specifications, so work does not depend on remembering earlier chat context.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/hahaxiang27/flowharness/harness.exec
Clone the repo
git clone --depth 1 https://github.com/hahaxiang27/FlowHarness

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for harness-exec

README.md
[![agentmods](https://agentmods.dev/badge/commands/hahaxiang27/flowharness/harness.exec.svg)](https://agentmods.dev/commands/hahaxiang27/flowharness/harness.exec)
Your own site
<a href="https://agentmods.dev/commands/hahaxiang27/flowharness/harness.exec"><img src="https://agentmods.dev/badge/commands/hahaxiang27/flowharness/harness.exec.svg" alt="Measured on agentmods" height="20"></a>
Per session 27 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,534 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00027 $0.03534
Opus 5 $0.00014 $0.01767
Sonnet 5 $0.00005 $0.00707
Haiku 4.5 $0.00003 $0.00353

Measured 5d ago against content hash dc2c158efa92, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

harness-exec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/harness.exec.md · 250 lines

How it starts

The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Harness 任务执行(Generator)

上下文管理: ✅ 保持当前上下文,但采用轻量级上下文策略

核心原则:依赖磁盘文件,不依赖对话记忆

每个任务的上下文来源:
1. spec文档(如 `[DATA_MODEL_DOC]`, `[API_CONTRACT_ROOT]`)→ 直接 Read 文件
2. 前置任务的产出 → Read 磁盘上已生成的代码文件,不是回忆对话历史
3. Generator模板 → 内化规则,不需要每次重新加载全文

❌ 错误:在上下文中保留前5个任务的完整对话过程
✅ 正确:每个任务只 Read 它直接依赖的已生成文件

指令

执行当前 Sprint 中的下一个(或指定的)任务。

输入参数

$ARGUMENTS — 可选,指定任务ID(如 "T009")或 "batch"。不指定则自动取进度文件中的下一个未完成任务。

执行步骤

  1. 定位任务:

    • 找到最新的 sprint-*-progress.md 文件
    • 如果用户指定了任务ID,执行该任务
    • 否则找到第一个状态为 [ ] 的行(包括 🚧 批次门禁行)
    • ⛔ 批次门禁规则: 如果下一个 [ ] 行是 🚧 批次门禁必须先执行 L1 Step 4 验证并标记通过,才能继续后续任务。不得跳过门禁行去执行下一个普通任务。门禁行的执行方式见步骤 4 中 Step 4 的说明。
  2. 加载最小上下文(关键:只读必要文件,从磁盘读不从记忆读):

    判断任务类型,按类型加载:

    任务类型 从 spec 文档读 从磁盘已生成文件读
    数据迁移 [DATA_MODEL_DOC](仅相关对象段落)
    数据模型 [DATA_MODEL_DOC](仅相关对象段落) 对应迁移/结构定义(确认字段与约束)
    业务逻辑单元 [API_CONTRACT_ROOT](对应接口) + spec.md(对应验收场景) 依赖的数据模型/业务接口(确认字段和方法签名)
    接口入口 [API_CONTRACT_ROOT](对应接口) 依赖的业务逻辑单元(确认方法签名)
    用户界面接口适配 [API_CONTRACT_ROOT](对应接口) 无(直接按契约生成)
    用户界面页面/组件 spec.md(对应验收场景) 对应的用户界面接口适配(确认可用函数)
    提示模板 spec.md(相关场景描述)
  3. 执行 Generator(TDD 流程):

    根据 .harness/prompts/generator.md 中对应模板执行。 含业务逻辑的任务必须遵循 TDD

    Step 1 — Red:   先写测试,定义预期行为,确认测试失败
    Step 2 — Green: 写最小实现代码,使测试通过
    Step 3 — Refactor: 重构代码,保持测试通过
    

    不含业务逻辑的任务(数据迁移、配置、数据模型、传输对象)不要求 TDD。

  4. 执行 Evaluator Level 1 — CI 门禁(强制,自动化):

    模拟 CI/CD 流水线,按顺序执行,任一步失败则阻断,不得进入 L2

    ┌─────────────────────────────────────────────────────┐
    │ Step 1: 单元测试(门禁)                              │
    │                                                     │
    │ [TEST_COMMAND]                                      │
    │                                                     │
    │ ⛔ 阻断规则:                                         │
    │ - 任务含业务逻辑但无测试文件 → FAIL(未完成)           │
    │ - 任何测试失败 → FAIL                                │
    │ - 测试不通过不得进入下一步                             │
    ├─────────────────────────────────────────────────────┤
    │ Step 2: 编译                                        │
    │                                                     │
    │ [BUILD_COMMAND]                                     │
    │ [TYPECHECK_COMMAND](如项目需要独立类型检查)           │
    ├─────────────────────────────────────────────────────┤
    │ Step 3: Lint                                        │
    │                                                     │
    │ [LINT_COMMAND] 无 ERROR                              │
    ├─────────────────────────────────────────────────────┤
    │ Step 4: 应用启动 + 集成验证(批次完成时执行)             │
    │                                                     │
    │ 4a. 启动项目依赖服务(如适用)→ 依赖健康                │
    │ 4b. [APP_START_COMMAND] → health UP + 数据迁移 OK     │
    │ 4c. [UI_START_COMMAND] → 页面可访问                   │
    │ 4d. 接口集成: 读取 [API_CONTRACT_ROOT] 构造真实请求     │
    │     对已实现的每个接口验证正常+异常路径                │
    │                                                     │
    │ ⛔ 编译通过 ≠ 能启动,启动成功 ≠ 功能可用              │
    │ 触发时机: 每个批次完成后 / Sprint Checkpoint           │
    └─────────────────────────────────────────────────────┘
    
    全部 ✅ → 进入 Level 2
    任一 ❌ → 进入 Corrector(最多3轮),3轮后仍失败则阻塞报告
    

Read the full file on GitHub · 250 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 250 lines · 27 tokens per session scan A dc2c158efa92

Subscribe to this mod's changes

harness-exec is a command published in the GitHub repository hahaxiang27/FlowHarness (4 stars, last pushed 2mo ago), licensed MIT. It adds 27 tokens to every session and 3,534 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.