Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hafeok/product-cli/product-session-e2enpx skills add Hafeok/product-cli --skill product-session-e2egit clone --depth 1 https://github.com/Hafeok/product-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00090 | $0.00665 |
| Opus 5 | $0.00045 | $0.00332 |
| Sonnet 5 | $0.00018 | $0.00133 |
| Haiku 4.5 | $0.00009 | $0.00067 |
Grade A, and why
product-session-e2e scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Product Session — end-to-end shake-out
Confirms the product-what / product-how / product-build skills still work as a set against a brand-new repo, driven entirely through the CLI (the canonical surface; the MCP tools are a transport over the same logic). Run it whenever the tool surface changes.
Run it
bash scripts/checks/session-e2e.sh # uses target/debug/product
PRODUCT=/abs/path/to/product bash scripts/checks/session-e2e.sh # pin a binary
The script is self-contained: it makes a fresh tmp repo, runs the sequence below,
prints PASS/FAIL per step, and exits non-zero if any step or assertion fails.
What it drives (each phase skill's worked example)
- init —
product init --demo --yes --name bookstore(seeds the What). - product-what —
domain validate→domain new value-object→ re-validate. - product-how —
how init→how add decision|principle|pattern(the principle is--enforced-byso it earns its place, §4.1) →how set app-contract→how validate→archetype init→cell init→cell dispatch --bind entity=Order(produces a real work unit). - product-build —
slice new→deliverable new(acceptance asid: statement, §7.2) →build --dry-run. - assertions — the build run-plan uses the dispatched work unit
(
handler-order, not a fallback) and the gate reports domain conformance.
When it fails
Each FAIL prints the offending command's last lines. Common causes:
- A renamed/removed tool or flag → update the matching phase skill and this script together (they must stay in lockstep).
- A new conformance rule (e.g. §4.1 earn-their-place) the worked example trips → fix the example to satisfy it, then mirror the fix in the phase skill.
Note on session gating
This runs the CLI, which has no phase lock, so it exercises the underlying
capability rather than the gated ordering. Inside a real product mcp --workflow
session the phases gate the tools — in particular cell dispatch / work-unit
authoring are How-phase and freeze in Build, so a session must dispatch work
units before advancing (see product-how / product-build).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 56 lines · 90 tokens per session scan A 404e50300964
product-session-e2e is a skill published in the GitHub repository Hafeok/product-cli (6 stars, last pushed 5d ago), licensed MIT. It adds 90 tokens to every session and 665 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-host-e2e-tests
Use when writing, recording, updating, or troubleshooting the agent host end-to-end tests under src/vs/platform/agentHost/test/node/e2e (black-box tests that drive the whole agent host over the AHP protocol, using a CapiReplayProxy record/replay system for Claude/Copilot/Codex). Covers adding a cross-provider test…
use-agent-browser-for-airi
Test AIRI display-model imports with agent-browser across stage-tamagotchi Electron, stage-web, and stage-pocket mobile web layouts. Use when uploading and verifying contributor-supplied Live2D ZIP, VRM, or MMD ZIP/PMX/PMD files through AIRI's model selector, including onboarding bypass, format-specific import…
cli-e2e-testcase-writer
Use when adding or updating Go CLI E2E coverage for one tests/clie2e/{domain} domain of the compiled lark-cli, especially when the work requires live --help or schema exploration, scenario-based clie2e.RunCmd workflows, and per-domain coverage.md maintenance.
docs-build
Build, preview, and validate the Uno documentation website (DocFX) locally — surface real content errors vs expected noise, drive rendered pages with Playwright, and validate external-doc commit bumps in importexternaldocs.ps1 before a PR. Use when working under doc/, editing articles/ markdown, bumping an external…
harness-test-writer
Add regression test cases to the Bifrost provider harness (the Postman collection run via make run-provider-harness-test) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts…
agent-device-evidence
Records iOS/Android native MP4 evidence for test/repro flows extracted from an Expensify GitHub PR or issue. Use when the user asks to "record the flow for PR.