harness-update

harness-update is a command for Claude Code from harnessworks/harness-starter-kit. It costs 0 tokens per session (1,565 once invoked), scanned A, original, MIT.

A repository maintenance command that updates a project's Harness Starter Kit reference and applies selected safe improvements. A repository is the folder containing a project's code and configuration.

In plain words
What is it for?
It is for refreshing harness guidance, comparing changes with the starter kit, tracking the source commit, and reporting what was updated.
Why use it?
It helps keep shared development guidance current without blindly replacing files that the project already owns.

Command for Claude Code

Written for Claude Code: a Claude Code command (commands/*.md). Also seen: mentions CLAUDE.md; mentions AGENTS.md.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/harnessworks/harness-starter-kit/harness-update
Clone the repo
git clone --depth 1 https://github.com/harnessworks/harness-starter-kit

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for harness-update

README.md
[![agentmods](https://agentmods.dev/badge/commands/harnessworks/harness-starter-kit/harness-update.svg)](https://agentmods.dev/commands/harnessworks/harness-starter-kit/harness-update)
Your own site
<a href="https://agentmods.dev/commands/harnessworks/harness-starter-kit/harness-update"><img src="https://agentmods.dev/badge/commands/harnessworks/harness-starter-kit/harness-update.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,565 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.01565
Opus 5 $0.00000 $0.00783
Sonnet 5 $0.00000 $0.00313
Haiku 4.5 $0.00000 $0.00156

Measured 6d ago against content hash 94e2dec52e21, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

harness-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/harness-update.md · 158 lines

How it starts

The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/harness update

Update a target repository's harness from the latest harness-starter-kit reference material.

Harness Update is allowed to modify target repository files, but it must never blindly overwrite existing target files. The target repository remains the source of truth.

Goal

Refresh the local ./harness-starter-kit reference clone, compare the target repository's recorded harness source against the updated kit, apply only safe and useful harness improvements, and finish with a clear update report.

Source Tracking

Record the kit source used by the target repository in .harness/source.json:

{
  "kit_url": "https://github.com/harnessworks/harness-starter-kit",
  "kit_commit": "<current-kit-commit>",
  "updated_at": "YYYY-MM-DD",
  "update_command": "/harness update"
}

This file belongs to the target repository. It is not a file inside the ./harness-starter-kit clone.

If .harness/source.json is missing, treat the previous kit commit as unknown. If ./harness-starter-kit already exists, use its current HEAD as fallback evidence before updating.

Procedure

  1. Treat the current working directory as the target repository root.
  2. Inspect target repository state before changing files:
    • git status --short --branch
    • existing AGENTS.md, README.md, CLAUDE.md, contribution docs, CI configs, package manifests, and harness scripts
    • existing .harness/source.json, if present
    • if the target worktree is dirty, record which files were already modified before the update and treat them as pre-existing target changes
  3. Refresh the kit reference:
    • If ./harness-starter-kit does not exist, clone https://github.com/harnessworks/harness-starter-kit into that path.
    • If it exists, inspect git -C harness-starter-kit status --short, git -C harness-starter-kit remote -v, and git -C harness-starter-kit rev-parse HEAD.
    • If the clone is clean and points to the expected remote, run git -C harness-starter-kit pull --ff-only origin main.
    • If the clone is dirty, has a different remote, is not a Git repository, or cannot fast-forward, do not delete or replace it. Report manual resolution instead.
  4. Compare the previous kit commit from .harness/source.json with the updated kit HEAD when both are available.
  5. If the target worktree was dirty before the update, keep source tracking separate from target mutation:
    • still use the latest confirmed kit commit after the reference clone was refreshed, when refresh was possible
    • update .harness/source.json to the latest confirmed kit commit when the source is known, even if some target file patches are deferred
    • do not patch target files that were already dirty unless the user explicitly approves the specific file or the patch is clearly non-conflicting
    • classify changes to pre-existing dirty target files as deferred or manual review when unsure
    • separate pre-existing target changes from update-applied changes in the report
  6. Classify kit changes and target update opportunities:
    • safe candidate: new baseline files that do not conflict with target files.
    • patch carefully: existing target files such as AGENTS.md, drift checks, adoption reports, or local docs that may need a small adapted patch.
    • reference only: templates, profiles, examples, or README guidance that should inform the agent but should not be copied directly.
    • manual review: CI workflows, package scripts, pre-commit hooks, dependency rules, architecture constraints, or anything that changes the target's normal development workflow.
  7. Apply only changes that fit the target repository's existing architecture, package manager, docs, and verification path.
  8. Never overwrite an existing target file wholesale. Patch existing files carefully after reading them.
  9. Update .harness/source.json only after the updated kit source is known and the report can explain what was applied, skipped, or deferred.
  10. If the update fixes a user-visible runtime failure or high-risk bug path that should not recur, including a 5xx error, crash, security or permission bug, data-loss risk, failed CI run, failed harness check, repeated agent mistake, previously identified bug path, or cross-environment mismatch, add a docs/failures/*.md record unless the issue was purely transient or already covered by an existing failure note. Name the regression test, fixture, smoke check, lint rule, drift check, CI gate, or manual review point that prevents or detects recurrence. If no failure note or check is added, explain why in the update report.
  11. Run relevant local checks, such as docs drift, structure drift, effectiveness plan checks, project tests, linting, type checks, or /harness doctor.

Read the full file on GitHub · 158 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 158 lines · 0 tokens per session scan A 94e2dec52e21

Subscribe to this mod's changes

harness-update is a command published in the GitHub repository harnessworks/harness-starter-kit (113 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,565 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.