setup

setup is a skill for Claude Code, Codex from orwa-mahmoud/nightshift. It costs 27 tokens per session (4,674 once invoked), scanned B, original, MIT.

A setup helper for Nightshift, a system for organising coding work into shifts. It creates the project’s .nightshift files and proposes quality checks suited to the project’s technology stack.

In plain words
What is it for?
Use it to add Nightshift to a project, configure its task and decision records, discuss stack-specific checks, and receive a setup summary.
Why use it?
It prepares the project’s tracking files and lets the owner decide which quality gates to use. It does not impose those checks automatically.

Skill for Claude CodeCodex

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the nightshift plugin — 13 skills, 4 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/orwa-mahmoud/nightshift/setup
Any agent
npx skills add orwa-mahmoud/nightshift --skill setup
Clone the repo
git clone --depth 1 https://github.com/orwa-mahmoud/nightshift

Made for: Claude Code, Codex.

Or install nightshift, the plugin that ships this one along with the rest of its 13 skills, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for setup

README.md
[![agentmods](https://agentmods.dev/badge/skills/orwa-mahmoud/nightshift/setup.svg)](https://agentmods.dev/skills/orwa-mahmoud/nightshift/setup)
Your own site
<a href="https://agentmods.dev/skills/orwa-mahmoud/nightshift/setup"><img src="https://agentmods.dev/badge/skills/orwa-mahmoud/nightshift/setup.svg" alt="Measured on agentmods" height="20"></a>
Per session 27 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,674 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00027 $0.04674
Opus 5 $0.00014 $0.02337
Sonnet 5 $0.00005 $0.00935
Haiku 4.5 $0.00003 $0.00467

Measured yesterday against content hash 6b815d9269d3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

`$TASK_ROOT/.claude/settings.local.json` (create the file if absent; never clobber keys
plugins/nightshift/skills/setup/SKILL.md · 283 lines

How it starts

The opening of the file, as written. The whole thing — 283 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Set up Nightshift in this project. Do the scaffolding first, then the gates conversation, then print a summary.

State map: punch-list.md → owner-approved work active in this shift; drafting-table.md → known work staged for a later shift; parking-lot.md → unresolved owner decisions plus the default chosen so work continues; work-orders.md → timed catalog work composed only through Hunt. Ordinary plans belong in the drafting table, never in Hunt or the parking lot.

Resolve the host-opened project folder to an absolute $TASK_ROOT: use ${CLAUDE_PROJECT_DIR} on Claude Code; on Codex honor Nightshift's ${CODEX_PROJECT_DIR} recovery override when present, otherwise capture pwd -P before any other shell call. If $TASK_ROOT/.nightshift-link exists, validate the one absolute workspace path inside it and call that $NIGHTSHIFT_WORKSPACE; otherwise set NIGHTSHIFT_WORKSPACE="$TASK_ROOT".

Bind the Nightshift directory once: NS="$NIGHTSHIFT_WORKSPACE/.nightshift". On native Windows, $NS = Join-Path $NIGHTSHIFT_WORKSPACE '.nightshift'. After this bind, Nightshift files are $NS/<name> for every read, write, and shell command. Catalog and owner-facing prose may use the short names (punch-list.md, parking-lot.md, STOP). Never re-resolve. Helpers that take --project or -Project still receive "$NIGHTSHIFT_WORKSPACE". Never search surrounding folders or guess. On Claude Code, .claude/ settings stay at $TASK_ROOT. The shell's working directory persists between Bash calls, so never rely on a bare relative path.

Resolve the installed plugin root to an absolute $NIGHTSHIFT_PLUGIN_ROOT: use ${CLAUDE_PLUGIN_ROOT} on Claude Code; on Codex use $PLUGIN_ROOT when available, otherwise derive it from the absolute path attached to this skill (skills/setup/SKILL.md). Substitute that absolute path in every command below; never search for the plugin.

On native Windows, use the PowerShell tool and native paths throughout: the host variables are $env:CLAUDE_PROJECT_DIR, $env:CODEX_PROJECT_DIR, and $env:PLUGIN_ROOT, with [Environment]::CurrentDirectory as the Codex cwd fallback. Do not route setup through WSL or Git Bash. Once the workspace and work target are resolved, the bundled mechanical scaffold is:

& "$NIGHTSHIFT_PLUGIN_ROOT\runtime\windows\setup.ps1" `
 -Project "$NIGHTSHIFT_WORKSPACE" -WorkTarget "$WORK_TARGET" -Mode "$WORK_MODE"

It copies only absent files, writes state version 1 for a new site, persists the work target and work mode (-Mode repository or -Mode artifact), and keeps $NS/ private. It refuses a notes folder under default repository mode: pass -Mode artifact for a notes folder that is not a Git repository. The skill still owns every owner choice below; the script asks nothing and never invents gates, permissions, profiles, migration approval, or a receipts choice.

If the user explicitly identifies a different existing workspace containing .nightshift/, show both absolute paths and ask for confirmation. On yes, run "$NIGHTSHIFT_PLUGIN_ROOT/runtime/link-workspace.sh" --host-root "$TASK_ROOT" --workspace "$PROPOSED_WORKSPACE". On native Windows, run & "$NIGHTSHIFT_PLUGIN_ROOT\runtime\windows\link-workspace.ps1" -HostRoot "$TASK_ROOT" -Workspace "$PROPOSED_WORKSPACE" instead. The pointer is local-only and state remains in the authoritative workspace; never copy it.

0. Reject disposable ChatGPT scratch workspaces

Before creating or changing any file, resolve the project root to an absolute path. If it is under /workspace/scratch/, this is a disposable ChatGPT scratch workspace that cannot affect the user's repository. Stop immediately: create no $NS/ directory, rules, settings, receipts repo, or other files. Tell the user directly:

Nightshift needs a persistent software project workspace. This ChatGPT conversation is using a temporary workspace, so files created here will not affect your repository.

Open your project in Codex (a Git repository or a persistent local folder), or start Codex connected to its GitHub repository. Then mention Nightshift and say: “Set up Nightshift in this project.”

Read the full file on GitHub · 283 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed 6b815d9269d3
  2. 5d ago First seen · 283 lines · 27 tokens per session scan B 1c227a9633ed

Subscribe to this mod's changes

setup is a skill published in the GitHub repository orwa-mahmoud/nightshift (51 stars, last pushed today), licensed MIT. It adds 27 tokens to every session and 4,674 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.