Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gjsify/gjsify/gjsify-committed-artifactsnpx skills add gjsify/gjsify --skill gjsify-committed-artifactsgit clone --depth 1 https://github.com/gjsify/gjsifyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00130 | $0.00994 |
| Opus 5 | $0.00065 | $0.00497 |
| Sonnet 5 | $0.00026 | $0.00199 |
| Haiku 4.5 | $0.00013 | $0.00099 |
Grade A, and why
gjsify-committed-artifacts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
gjsify — GJS bundles and what a green build proves
In this repo the code you edited is very often not the code that runs. That is still
true after ADR 0002 untracked cli.gjs.mjs and tsc.gjs.mjs — the reason changed, and the
new one is quieter.
1. A stale LOCAL build output shadows your source edit, and nothing in CI sees it
node_modules/.bin/gjsify dispatches to packages/infra/cli/dist/cli.gjs.mjs whenever
gjs is on PATH and that file exists, and only falls back to packages/infra/cli/lib/index.js.
Both are build outputs. So after you edit src/, the shim keeps running the last bundle you
built until you rebuild it — and since the file is no longer committed, CI cannot tell you:
it builds its own from your source.
Fix: gjsify run build (or gjsify workspace @gjsify/cli build for just the CLI). If a change
seems to do nothing, check the bundle's mtime before you debug the change.
2. affected.gjs.mjs is the one artifact still committed, and its staleness FAILS OPEN
packages/infra/cli/dist/affected.gjs.mjs is the Soup-free CI classifier. The changes job
boots it on a plain ubuntu+gjs host before any install, and it gates every other job. A
stale copy does not error — it classifies today's PR with an older commit's tables, and the
run looks green while having skipped work.
- Rebuild:
gjsify workspace @gjsify/cli build && gjsify workspace @gjsify/cli build:affected-bundle - CI byte-compares it against
git show HEAD:inscripts/verify-committed-bundles.mjs. .githooks/pre-commitrebuilds + re-stages it whenpackages/infra/cli/{src,package.json},resolve-npm/lib/orrolldown-plugin-gjsify/src/is staged.
3. The hook is BEST-EFFORT — never read a green pre-commit as "the bundle is fresh"
Its trigger list is four paths; the bundle inlines the whole workspace-dep closure. Measured
2026-08-06: a commit touching packages/web/dom-events + packages/web/abort-controller —
neither of which looks like CLI infrastructure — staled all three artifacts by +18 B each and
the hook stayed silent, correctly, because no trigger path matched. It also warns-and-skips
with no reachable CLI or no node_modules (a bare worktree, the #821 case). The exhaustive
check is CI's rebuild-and-compare. post-rewrite no longer exists — see
docs/build-artifacts.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 58 lines · 0 tokens per session scan A b6d7c85b1af3
gjsify-committed-artifacts is a skill published in the GitHub repository gjsify/gjsify (20 stars, last pushed 2d ago), licensed MIT. It adds 130 tokens to every session and 994 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
docs-svg-kit
Author SVG figures for Grida docs — diff-able, version-controlled vector diagrams embedded in doc pages instead of screenshots. Provides reusable primitives (selection chrome, size badges, anchor pins, resize cursors, click ripples), color/typography tokens, a starter template, and finished examples to crib from.…
editor-perf
Guides performance investigation, benchmarking, and optimization of the Grida Canvas web editor (TypeScript reducer, Immer, React hooks). Use when profiling reducer dispatch cost, diagnosing slow interactions (drag, resize, color change), writing or running editor benchmarks, instrumenting with PerfObserver, or…
deck-open-slide-canvas
锁死 1920×1080 画布, React 组件级自由组合, 不绑模板.
ai-models
Research, compare, and update AI model configurations. Covers text model tiers, image and video generation models, image tool models, pricing data sourcing, and provider-cost metering against prepaid org credit. Use when bumping model versions, adding new models, updating pricing, or auditing model specs against…
sdk-design
Doctrine for designing and evolving any SDK Grida ships — TypeScript, Rust, or otherwise. "SDK" here means a surface that crosses a foreign-or-foreign-treated boundary: published packages, separately-versioned consumers, FFI bindings, public-by-design modules. An SDK's job is to refuse; a strict, honest surface…
database
Use BEFORE editing any file in supabase/migrations/ or supabase/schemas/, OR when the user runs a /database subcommand (compact local migration, rls scenarios, align). Encodes the three contracts that protect the Grida database layer: applied migrations are immutable, RLS implementation mirrors tests (never the…