Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/tsedio/tsed-cli/opsx-applygit clone --depth 1 https://github.com/tsedio/tsed-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00010 | $0.01047 |
| Opus 5 | $0.00005 | $0.00524 |
| Sonnet 5 | $0.00002 | $0.00209 |
| Haiku 4.5 | $0.00001 | $0.00105 |
Grade A, and why
opsx-apply scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
84% identical to OPSX: Apply — 25 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Implement tasks from an OpenSpec change.
Input: Optionally specify a change name (e.g., /opsx:apply add-auth). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
Steps
-
Select the change
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run
openspec list --jsonto get available changes and use the AskUserQuestion tool to let the user select
Always announce: "Using change: " and how to override (e.g.,
/opsx:apply <other>). -
Check status to understand the schema
openspec status --change "<name>" --jsonParse the JSON to understand:
schemaName: The workflow being used (e.g., "spec-driven")- Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
-
Get apply instructions
openspec instructions apply --change "<name>" --jsonThis returns:
- Context file paths (varies by schema)
- Progress (total, complete, remaining)
- Task list with status
- Dynamic instruction based on current state
Handle states:
- If
state: "blocked"(missing artifacts): show message, suggest using/opsx:continue - If
state: "all_done": congratulate, suggest archive - Otherwise: proceed to implementation
-
Read context files
Read the files listed in
contextFilesfrom the apply instructions output. The files depend on the schema being used:- spec-driven: proposal, specs, design, tasks
- Other schemas: follow the contextFiles from CLI output
-
Show current progress
Display:
- Schema being used
- Progress: "N/M tasks complete"
- Remaining tasks overview
- Dynamic instruction from CLI
-
Implement tasks (loop until done or blocked)
For each pending task:
- Show which task is being worked on
- Make the code changes required
- Keep changes minimal and focused
- Mark task complete in the tasks file:
- [ ]→- [x] - Continue to next task
Pause if:
- Task is unclear → ask for clarification
- Implementation reveals a design issue → suggest updating artifacts
- Error or blocker encountered → report and wait for guidance
- User interrupts
-
On completion or pause, show status
Display:
- Tasks completed this session
- Overall progress: "N/M tasks complete"
- If all done: suggest archive
- If paused: explain why and wait for guidance
Output During Implementation
## Implementing: <change-name> (schema: <schema-name>)
Working on task 3/7: <task description>
[...implementation happening...]
✓ Task complete
Working on task 4/7: <task description>
[...implementation happening...]
✓ Task complete
Output On Completion
## Implementation Complete
**Change:** <change-name>
**Schema:** <schema-name>
**Progress:** 7/7 tasks complete ✓
### Completed This Session
- [x] Task 1
- [x] Task 2
...
All tasks complete! Ready to archive this change.
Output On Pause (Issue Encountered)
## Implementation Paused
**Change:** <change-name>
**Schema:** <schema-name>
**Progress:** 4/7 tasks complete
### Issue Encountered
<description of the issue>
**Options:**
1. <option 1>
2. <option 2>
3. Other approach
What would you like to do?
Guardrails
- Keep going through tasks until done or blocked
- Always read context files before starting (from the apply instructions output)
- If task is ambiguous, pause and ask before implementing
- If implementation reveals issues, pause and suggest artifact updates
- Keep code changes minimal and scoped to each task
- Update task checkbox immediately after completing each task
- Pause on errors, blockers, or unclear requirements - don't guess
- Use contextFiles from CLI output, don't assume specific file names
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 163 lines · 10 tokens per session scan A 6c15e9288e07
opsx-apply is a command published in the GitHub repository tsedio/tsed-cli (43 stars, last pushed 13d ago), licensed MIT. It adds 10 tokens to every session and 1,047 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 84% identical to OPSX: Apply, differing in 25 lines, and is treated as a copy.
Other commands, from other repositories
loci-sync
Sync information between this project and the Loci brain index. Keep full project memory in the project repo.
release-note-csoar
Automates the creation of Cloud SOAR (Automation Service) release notes for platform updates, integration changes, and bug fixes.
doc
Use this command to create a new feature doc, how-to, concept, reference, or troubleshooting guide — it scaffolds the file, frontmatter, structure, and sidebar entry.
audit-ssl
Audit ZIA SSL inspection rules -- list rules by action (INSPECT, DONOTINSPECT, DONOTDECRYPT, BLOCK), identify bypasses, and assess risk.
investigate-incident
Investigate security incidents using Z-Insights analytics -- threats, firewall actions, shadow IT, and web traffic.
loci-scan
Refresh the current project's local Loci memory.