Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/harnessworks/harness-starter-kit/harness-updategit clone --depth 1 https://github.com/harnessworks/harness-starter-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/harnessworks/harness-starter-kit/harness-update)<a href="https://agentmods.dev/commands/harnessworks/harness-starter-kit/harness-update"><img src="https://agentmods.dev/badge/commands/harnessworks/harness-starter-kit/harness-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01565 |
| Opus 5 | $0.00000 | $0.00783 |
| Sonnet 5 | $0.00000 | $0.00313 |
| Haiku 4.5 | $0.00000 | $0.00156 |
Grade A, and why
harness-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/harness update
Update a target repository's harness from the latest
harness-starter-kit reference material.
Harness Update is allowed to modify target repository files, but it must never blindly overwrite existing target files. The target repository remains the source of truth.
Goal
Refresh the local ./harness-starter-kit reference clone, compare the target
repository's recorded harness source against the updated kit, apply only safe
and useful harness improvements, and finish with a clear update report.
Source Tracking
Record the kit source used by the target repository in .harness/source.json:
{
"kit_url": "https://github.com/harnessworks/harness-starter-kit",
"kit_commit": "<current-kit-commit>",
"updated_at": "YYYY-MM-DD",
"update_command": "/harness update"
}
This file belongs to the target repository. It is not a file inside the
./harness-starter-kit clone.
If .harness/source.json is missing, treat the previous kit commit as
unknown. If ./harness-starter-kit already exists, use its current HEAD as
fallback evidence before updating.
Procedure
- Treat the current working directory as the target repository root.
- Inspect target repository state before changing files:
git status --short --branch- existing
AGENTS.md,README.md,CLAUDE.md, contribution docs, CI configs, package manifests, and harness scripts - existing
.harness/source.json, if present - if the target worktree is dirty, record which files were already modified before the update and treat them as pre-existing target changes
- Refresh the kit reference:
- If
./harness-starter-kitdoes not exist, clonehttps://github.com/harnessworks/harness-starter-kitinto that path. - If it exists, inspect
git -C harness-starter-kit status --short,git -C harness-starter-kit remote -v, andgit -C harness-starter-kit rev-parse HEAD. - If the clone is clean and points to the expected remote, run
git -C harness-starter-kit pull --ff-only origin main. - If the clone is dirty, has a different remote, is not a Git repository, or cannot fast-forward, do not delete or replace it. Report manual resolution instead.
- If
- Compare the previous kit commit from
.harness/source.jsonwith the updated kitHEADwhen both are available. - If the target worktree was dirty before the update, keep source tracking
separate from target mutation:
- still use the latest confirmed kit commit after the reference clone was refreshed, when refresh was possible
- update
.harness/source.jsonto the latest confirmed kit commit when the source is known, even if some target file patches are deferred - do not patch target files that were already dirty unless the user explicitly approves the specific file or the patch is clearly non-conflicting
- classify changes to pre-existing dirty target files as
deferredormanual reviewwhen unsure - separate pre-existing target changes from update-applied changes in the report
- Classify kit changes and target update opportunities:
safe candidate: new baseline files that do not conflict with target files.patch carefully: existing target files such asAGENTS.md, drift checks, adoption reports, or local docs that may need a small adapted patch.reference only: templates, profiles, examples, or README guidance that should inform the agent but should not be copied directly.manual review: CI workflows, package scripts, pre-commit hooks, dependency rules, architecture constraints, or anything that changes the target's normal development workflow.
- Apply only changes that fit the target repository's existing architecture, package manager, docs, and verification path.
- Never overwrite an existing target file wholesale. Patch existing files carefully after reading them.
- Update
.harness/source.jsononly after the updated kit source is known and the report can explain what was applied, skipped, or deferred. - If the update fixes a user-visible runtime failure or high-risk bug path that
should not recur, including a 5xx error, crash, security or permission bug,
data-loss risk, failed CI run, failed harness check, repeated agent mistake,
previously identified bug path, or cross-environment mismatch, add a
docs/failures/*.mdrecord unless the issue was purely transient or already covered by an existing failure note. Name the regression test, fixture, smoke check, lint rule, drift check, CI gate, or manual review point that prevents or detects recurrence. If no failure note or check is added, explain why in the update report. - Run relevant local checks, such as docs drift, structure drift, effectiveness
plan checks, project tests, linting, type checks, or
/harness doctor.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 158 lines · 0 tokens per session scan A 94e2dec52e21
harness-update is a command published in the GitHub repository harnessworks/harness-starter-kit (113 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,565 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
monitor-ci
Monitors pull request CI checks until they are resolved (pass or fail).
plan-regression-tests
Plan regression tests for existing code with it.skip statements.
coder-eval-implement-plan
Implement an approved codereval plan phase by phase with risk-scaled per-phase review, then a final code review.
milestone-list
PitWay: List every milestone with a concise one-line status.
review
Review proposed ADRs for lifecycle progression — accept implemented decisions, deprecate stale ones, archive trivial ones.
handoff
Export a Waybill Bundle by default, or import one when requested.