Borrowing it
Nothing to install: this file belongs to littlebearapps/untether. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/littlebearapps/untether/master/.claude/commands/debug/step-evidence.mdgit clone --depth 1 https://github.com/littlebearapps/untetherWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/littlebearapps/untether/step-evidence)<a href="https://agentmods.dev/commands/littlebearapps/untether/step-evidence"><img src="https://agentmods.dev/badge/commands/littlebearapps/untether/step-evidence/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/littlebearapps/untether/step-evidence"><img src="https://agentmods.dev/badge/commands/littlebearapps/untether/step-evidence.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03761 |
| Opus 5.5 | $0.00000 | $0.01504 |
| Sonnet 5.5 | $0.00000 | $0.00752 |
| Haiku 4.5 | $0.00000 | $0.00376 |
Grade A, and why
step-evidence scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| `event=subprocess.create.failed` | Couldn't spawn the engine CLI | runner-subprocess | How it starts
The opening of the file, as written. The whole thing — 294 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Step 2 — Gather evidence
This is the data-source catalogue for Untether debugging. Run the relevant sources for the classified issue type (Step 1). Don't skip — each surfaces different context.
Replace ${HOURS} with the window (default 24 for sweep, sized to fit the
issue's reported window in targeted mode).
2a. journalctl (lba-1 — five services)
Untether runs five services on lba-1:
| Service | Bot | Source |
|---|---|---|
untether.service |
@hetz_lba1_bot (staging) |
PyPI / TestPyPI wheel |
untether-dev.service |
@untether_dev_bot (dev) |
Local editable /home/nathan/untether/src/ |
untether-demo.service |
demo bot | Local editable, demo config |
untether-dev-hf.service |
handoff dev | Local editable, handoff config |
untether-dev-ws.service |
workspace dev | Local editable, workspace config |
# Per-service error/warning lines
for unit in untether untether-dev untether-demo untether-dev-hf untether-dev-ws; do
systemctl --user is-active "$unit.service" >/dev/null 2>&1 || continue
echo "=== $unit ==="
journalctl --user -u "$unit" --since "${HOURS}h ago" --output=cat \
| grep -E 'level=(error|warning)|"level":\s*"(error|warning)"' | head -200
done
For targeted mode, restrict to the affected service. Most issues live in
untether-dev (development) or untether (staging-PyPI); the demo/handoff/ws
services rarely surface novel bugs.
2b. Fleet — four remote hosts (nsd, channelo, sl, mac)
The fleet runs one untether service per host (the PyPI wheel). SSH from
lba-1 via the tailnet. The Linux VPSs use systemd; mac runs under launchd
(com.littlebearapps.untether) and has no journalctl — its output goes to
macOS Unified Logging (see contrib/com.littlebearapps.untether-issue-watcher.plist
for how the issue watcher reads it).
for host in nsd channelo sl; do
echo "=== $host ==="
ssh "$host" "journalctl --user -u untether --since '${HOURS}h ago' --output=cat \
| grep -E 'level=(error|warning)|\"level\":\\s*\"(error|warning)\"'" 2>/dev/null \
| head -200 || echo "(host unreachable)"
done
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed · +7 lines 39513700dc8f
- 1mo ago First seen · 287 lines · 0 tokens per session scan A e894d0f72075
step-evidence is a command published in the GitHub repository littlebearapps/untether (74 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,761 tokens. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
root-cause
Use when any test fails, bug appears, or behaviour surprises you, before proposing a fix - find the cause and prove it, by reading real evidence, tracing bad values back to their origin, comparing against a working case, and testing one hypothesis at a time.
refactor
Refactor and optimize [code].
hotfix
Emergency fix workflow with audit trail.
kotlin-build
Fix Kotlin/Gradle build errors, compiler warnings, and dependency issues incrementally. Invokes the kotlin-build-resolver agent for minimal, surgical fixes.
bug-report
Create structured bug report.
wtfp:report-bug
Collect a reproducible bug report and publish it only after explicit user approval.