@uzysjung/agent-harness 26.117.0 → 26.118.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.ko.md +41 -208
- package/README.md +42 -333
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,13 +1,6 @@
|
|
|
1
1
|
# uzys-agent-harness
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
Coding agents keep getting stronger out of the box — piling on skills and MCPs you'll never use just bloats their context window. And the awesome-lists have too many options to wade through. `agent-harness` does two things:
|
|
6
|
-
|
|
7
|
-
1. **Lean curation by tech stack** — of the vetted options, you install only what this project actually calls for.
|
|
8
|
-
2. **A discipline layer** — rules, hooks, and CI scaffolds distilled from running real production projects with agents: doc governance, verification gates, benchmark-parity loops, recurrence prevention. That layer is what makes it a *harness*, not a skill pack ([details ↓](#the-discipline-layer--what-makes-it-a-harness)).
|
|
9
|
-
|
|
10
|
-
**Claude Code is fully supported (all assets, hooks, and plugins); Codex / OpenCode / Antigravity get the skills + rules layer.** Project scope by default — no global pollution unless you ask.
|
|
3
|
+
Install vetted AI-coding skills, plugins, rules, and hooks for Claude Code, Codex, OpenCode, and Antigravity — one interactive wizard, scoped to your project.
|
|
11
4
|
|
|
12
5
|
[](LICENSE)
|
|
13
6
|
[](https://github.com/uzysjung/uzys-agent-harness/releases)
|
|
@@ -15,8 +8,6 @@ Coding agents keep getting stronger out of the box — piling on skills and MCPs
|
|
|
15
8
|
|
|
16
9
|
|
|
17
10
|
|
|
18
|
-
> **What "vetted" means** — ≥ 1000 GitHub stars + active maintenance + a Docker install-verification run (51/65 assets green today), re-checked monthly by a CI cron ([catalog-verify](docs/COMPATIBILITY.md), [trust-tier-drift](.github/workflows/)). It is **not** a line-by-line security audit or a prompt-injection scan of asset contents. npm/npx assets are version-pinned; **plugin/skill assets resolve to upstream HEAD (not commit-pinned yet)**. Treat installed assets like any third-party dependency — see [SECURITY.md](SECURITY.md).
|
|
19
|
-
|
|
20
11
|
🇰🇷 [한국어](./README.ko.md)
|
|
21
12
|
|
|
22
13
|
---
|
|
@@ -27,366 +18,84 @@ Coding agents keep getting stronger out of the box — piling on skills and MCPs
|
|
|
27
18
|
npx -y @uzysjung/agent-harness
|
|
28
19
|
```
|
|
29
20
|
|
|
30
|
-
|
|
21
|
+
The wizard walks through six steps:
|
|
31
22
|
|
|
32
23
|
```
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
24
|
+
1/6 Tracks pick your stack
|
|
25
|
+
2/6 CLI claude / codex / opencode / antigravity
|
|
26
|
+
3/6 Install items review pre-checked recommendations
|
|
27
|
+
4/6 Scope Project (default) or Global
|
|
28
|
+
5/6 Confirm
|
|
29
|
+
6/6 Installing
|
|
39
30
|
```
|
|
40
31
|
|
|
41
|
-
|
|
32
|
+
Then start your CLI — skills, rules, and hooks are active:
|
|
42
33
|
|
|
43
34
|
```bash
|
|
44
|
-
claude # or codex / opencode / agy
|
|
45
|
-
# skills, rules, and hooks are now active
|
|
35
|
+
claude # or codex / opencode / agy
|
|
46
36
|
```
|
|
47
37
|
|
|
48
|
-
|
|
38
|
+
**Project scope is the default.** Nothing is written to `~/.claude/`, `~/.codex/`, `~/.opencode/`, `~/.gemini/`, or global npm unless you pick Global at step 4.
|
|
49
39
|
|
|
50
|
-
|
|
40
|
+
**Safe on an existing project.** Before replacing an editable file whose contents differ, the installer writes a timestamped backup next to it and prints every backup path in the summary. Nothing is deleted.
|
|
51
41
|
|
|
52
|
-
|
|
53
|
-
npx -y @uzysjung/agent-harness install \
|
|
54
|
-
--track tooling --cli claude --scope project \
|
|
55
|
-
--with bmad-method
|
|
56
|
-
```
|
|
57
|
-
|
|
58
|
-
| Flag | Meaning |
|
|
59
|
-
|------|---------|
|
|
60
|
-
| `--track <name>` | Track to install (repeatable) |
|
|
61
|
-
| `--cli <target>` | `claude` / `codex` / `opencode` / `antigravity` (repeatable) |
|
|
62
|
-
| `--scope <s>` | `project` (default) or `global` |
|
|
63
|
-
| `--with <asset-id>` / `--without <asset-id>` | Add / remove any catalog asset by id (repeatable) — ids in the [compatibility matrix](docs/COMPATIBILITY.md) |
|
|
42
|
+
The wizard needs a TTY. For CI, containers, or onboarding scripts there is a flag-based mode — see the [usage guide](docs/USAGE.md#non-interactive-install).
|
|
64
43
|
|
|
65
|
-
|
|
44
|
+
## Why
|
|
66
45
|
|
|
67
|
-
|
|
46
|
+
Coding agents keep getting stronger on their own. But every skill and MCP you install sits in the context window each session whether you use it or not, and the awesome-lists carry hundreds of options with no way to tell which ones your stack actually calls for. So you either install everything and pay for it every session, or read through the lists yourself each time you start a project.
|
|
68
47
|
|
|
69
|
-
|
|
48
|
+
This tool starts from the stack instead. You pick a track, and it pre-checks the assets that track calls for — you review and uncheck before anything installs.
|
|
70
49
|
|
|
71
|
-
|
|
72
|
-
|---|---|
|
|
73
|
-
| `csr-supabase` | react-best-practices · shadcn-ui · supabase-agent-skills · postgres-best-practices · supabase-cli · vercel-cli |
|
|
74
|
-
| `data` | polars · dask · anthropic-data-plugin |
|
|
50
|
+
## What you get
|
|
75
51
|
|
|
76
|
-
|
|
52
|
+
- **Curation by tech stack.** Of the vetted options, you install only what this project calls for. Pick `csr-supabase` and step 3 pre-checks React, shadcn, Supabase, and Postgres assets — not the other sixty.
|
|
77
53
|
|
|
78
|
-
|
|
54
|
+
- **A discipline layer.** Rules, hooks, and CI scaffolds distilled from running real production projects with agents: doc governance, verification gates, benchmark-parity loops, recurrence prevention. This layer is what makes it a harness rather than a skill pack.
|
|
79
55
|
|
|
80
|
-
|
|
56
|
+
- **Four CLIs, one vocabulary.** Claude Code is first class — all assets, hooks, and plugins. Codex, OpenCode, and Antigravity get the skills and rules layer. Your project is not locked to one CLI.
|
|
81
57
|
|
|
82
|
-
|
|
58
|
+
## Vetting
|
|
83
59
|
|
|
84
|
-
|
|
85
|
-
|---|---|---|
|
|
86
|
-
| **Direction** | `north-star` skill (all tracks) + `northstar-roadmap` ★ | vision doc → measured gaps → ranked backlog |
|
|
87
|
-
| **Doc governance** | `doc-governance` rule (all tracks) + `spec-drift-check` hook | SSOT hierarchy, "merge = code **and** tracking sync", current-vs-archive split |
|
|
88
|
-
| **Delivery** | `git-policy` · `change-management` · `gates-taxonomy` rules (all tracks) | conventional commits, ADRs for load-bearing decisions, 4 gate types |
|
|
89
|
-
| **Tests → CI** | `test-policy` rule (dev tracks) + `ci-scaffold` (opt-in) | coverage thresholds, TDD, real-DB **parity** CI templates (fill-in) in `.github/workflows/` |
|
|
90
|
-
| **Verification** | `reviewer` agent + `multi-persona-review` ★ | implementer ≠ verifier; multi-perspective review before ship |
|
|
91
|
-
| **Real-browser verification** | `playwright-launch` + `benchmark-parity` rules (UI tracks) | persistent-profile capture, gap matrix (`gap.md`), PR `## Fidelity` evidence |
|
|
92
|
-
| **Recurrence** | `recurrence-prevention` ★ (dev tracks) | repeat defect → escalate: record → forced rule → structural gate |
|
|
60
|
+
An asset is **vetted** when it has at least 1,000 GitHub stars, shows active maintenance, and passes an install-verification run in an isolated Docker container. A CI cron re-checks all three monthly.
|
|
93
61
|
|
|
94
|
-
|
|
62
|
+
Vetting is **not** a line-by-line security audit, and it does not scan asset contents for prompt injection. npm and npx assets are version-pinned; plugin and skill assets resolve to upstream HEAD and are not commit-pinned yet.
|
|
95
63
|
|
|
96
|
-
|
|
64
|
+
Treat installed assets like any other third-party dependency — see [SECURITY.md](SECURITY.md).
|
|
97
65
|
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
> Maintainer's direction statement (2026-07). The catalog itself is unchanged by this section — it describes how curation decisions are made going forward.
|
|
101
|
-
|
|
102
|
-
Frontier coding agents (Opus 4.8 / GPT-5.6 class) keep absorbing what skill packs used to teach. Our working position: **a skill has to earn its context cost** — every installed skill occupies the agent's attention even when unused, so the default install stays minimal and "more skills" is treated as a cost, not a feature.
|
|
103
|
-
|
|
104
|
-
What we believe still earns its place is the **insight layer**, not the knowledge layer:
|
|
105
|
-
|
|
106
|
-
- **Orchestration know-how** — model/effort role splits (`model-orchestration`), multi-perspective verification (`multi-persona-review`), auditing your own harness (`harness-health-audit`).
|
|
107
|
-
- **Cross-CLI leverage** — use each CLI for what it's best at: natural prose polish via Antigravity (`gemini-consult`), concise structuring + image generation via Codex (`codex-consult`).
|
|
108
|
-
- **Operational facts** — CLI flags, auth flows, deploy steps (`supabase-cli`, `railway-skills`, …) drift with upstream releases no matter how smart models get. Generic pattern guides are the first to become redundant.
|
|
109
|
-
|
|
110
|
-
Structured workflow bundles (superpowers, BMAD, OpenSpec, …) stay **opt-in and never pre-checked**. Our view: with strong models, an agile direction plus a firm git/PR policy beats enforced ceremony for solo/greenfield work — but multi-dev alignment, junior onboarding, and audit trails are human-side problems that no model upgrade solves, so the choice stays yours ([Workflow curation guide](docs/WORKFLOWS.md)).
|
|
111
|
-
|
|
112
|
-
What stays fixed is small and deterministic: git/PR policy, verification gates, honest reporting. Within those rails the agent develops flexibly — including running several agents in parallel in one session (safety conventions for that, like worktree isolation, are roadmap items, not shipped features). Since v26.103.0 the installer shows the **session-start context cost** of your selection (bundled skills measured from frontmatter, external assets honestly marked unmeasured), and our test suite holds the bundled-skill descriptors of the default install under a token budget (external assets stay unmeasured).
|
|
113
|
-
|
|
114
|
-
One honest note: this repository's *own* development harness is deliberately heavier than what it installs — it self-verifies an installer that writes into your project. Shipped defaults ≠ our dev rig.
|
|
115
|
-
|
|
116
|
-
---
|
|
117
|
-
|
|
118
|
-
## Installing into an existing project
|
|
119
|
-
|
|
120
|
-
`agent-harness` never silently overwrites your config. Before replacing an **editable** file whose contents differ, it writes a timestamped backup next to it — and every backup path is printed in the install summary (`backup` rows). Nothing is deleted.
|
|
121
|
-
|
|
122
|
-
| You already have… | What happens |
|
|
123
|
-
|---|---|
|
|
124
|
-
| `.claude/settings.json` with your own hooks / statusLine | Backed up to `settings.json.backup-<ts>` before update |
|
|
125
|
-
| Root `CLAUDE.md` (yours differs from the generated one) | Backed up to `CLAUDE.md.backup-<ts>` before the merge write |
|
|
126
|
-
| `.claude/` on `--reinstall` / `update` mode | The whole directory is renamed to `.claude.backup-<ts>` first |
|
|
127
|
-
| `.mcp.json` | Your existing MCP servers are preserved and merged, not replaced |
|
|
128
|
-
|
|
129
|
-
> Fresh project? None of this triggers — backups only protect pre-existing files.
|
|
130
|
-
|
|
131
|
-
---
|
|
66
|
+
Every asset carries its tier as a badge at step 3: **★ official** (Anthropic-official marketplaces and this harness's own assets), **vetted**, or **⚠ experimental** (under 1,000 stars, opt-in only). Tiers inform; they never block.
|
|
132
67
|
|
|
133
68
|
## Tracks
|
|
134
69
|
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
### Dev tracks
|
|
138
|
-
|
|
139
|
-
| Track | Stack |
|
|
140
|
-
|---|---|
|
|
141
|
-
| `csr-supabase` | Vite + React + Supabase |
|
|
142
|
-
| `csr-fastify` | Vite + React + Fastify |
|
|
143
|
-
| `csr-fastapi` | Vite + React + FastAPI |
|
|
144
|
-
| `ssr-nextjs` | Next.js (App Router) |
|
|
145
|
-
| `ssr-htmx` | HTMX + server-side |
|
|
146
|
-
| `data` | DuckDB + Polars + PySide6 |
|
|
147
|
-
| `full` | union of all dev tracks |
|
|
148
|
-
|
|
149
|
-
### Business tracks
|
|
150
|
-
|
|
151
|
-
| Track | Use |
|
|
152
|
-
|---|---|
|
|
153
|
-
| `executive` | proposals, due diligence, decks, financial models |
|
|
154
|
-
| `project-management` | PM workflow + reviews |
|
|
155
|
-
| `growth-marketing` | growth + content marketing |
|
|
156
|
-
|
|
157
|
-
### Meta
|
|
158
|
-
|
|
159
|
-
| Track | Use |
|
|
160
|
-
|---|---|
|
|
161
|
-
| `tooling` | Bash + Markdown meta-projects (no app stack) |
|
|
162
|
-
|
|
163
|
-
---
|
|
164
|
-
|
|
165
|
-
## What gets installed per track
|
|
166
|
-
|
|
167
|
-
External assets are recommended automatically based on your track selection. Step 3 shows them pre-checked; you can toggle anything before install.
|
|
168
|
-
|
|
169
|
-
### Frontend (csr-* / ssr-nextjs / full)
|
|
170
|
-
|
|
171
|
-
| Asset | What | Source |
|
|
172
|
-
|---|---|---|
|
|
173
|
-
| `frontend-design` | Distinctive production-grade UI generation — **default on all dev tracks** | Anthropic official |
|
|
174
|
-
| `react-best-practices` | React patterns and component guidelines | vercel-labs |
|
|
175
|
-
| `shadcn-ui` | Radix-based component copy + Tailwind theme | shadcn (official) |
|
|
176
|
-
| `web-design-guidelines` | UX/UI best practices — **opt-in** since v26.106.0 (`frontend-design` covers the default) | vercel-labs |
|
|
177
|
-
| `impeccable` | UI design, critique, and visual review skills — **opt-in** since v26.106.0 | pbakaus |
|
|
178
|
-
|
|
179
|
-
### Backend (csr-* / ssr-* / full)
|
|
180
|
-
|
|
181
|
-
| Asset | What | Source |
|
|
182
|
-
|---|---|---|
|
|
183
|
-
| `railway-skills` | Railway deploy + project/service/env management | Railway official |
|
|
184
|
-
| `supabase-agent-skills` (csr-supabase) | Supabase agent skills | Supabase official |
|
|
185
|
-
| `postgres-best-practices` (csr-supabase) | Postgres patterns | Supabase official |
|
|
186
|
-
| `supabase-cli` (csr-supabase) | Supabase CLI (`supabase login` for OAuth) | npm |
|
|
187
|
-
| `vercel-cli` (csr-supabase) | Vercel CLI | npm |
|
|
188
|
-
| `netlify-cli` | Netlify CLI — **opt-in** since v26.106.0 (deploy-CLI dedup; `vercel-cli` stays default at 10:1 weekly downloads) | npm |
|
|
189
|
-
|
|
190
|
-
### Data (data / full)
|
|
191
|
-
|
|
192
|
-
| Asset | What | Source |
|
|
193
|
-
|---|---|---|
|
|
194
|
-
| `polars-K-Dense` | Polars — fast Rust DataFrame (pandas alternative) | K-Dense-AI |
|
|
195
|
-
| `dask-K-Dense` | Dask — distributed processing | K-Dense-AI |
|
|
196
|
-
| `python-resource-management` | Memory / CPU management patterns — **opt-in** since v26.106.0 | wshobson |
|
|
197
|
-
| `python-performance-optimization` | Profiling + vectorization — **opt-in** since v26.106.0 | wshobson |
|
|
198
|
-
| `anthropic-data-plugin` | Visualization + SQL exploration | Anthropic official |
|
|
199
|
-
|
|
200
|
-
### Business (executive / project-management / growth-marketing)
|
|
201
|
-
|
|
202
|
-
| Asset | What | Source | Tracks |
|
|
203
|
-
|---|---|---|---|
|
|
204
|
-
| `anthropic-document-skills` | pptx / docx / xlsx / pdf authoring | Anthropic | executive · full |
|
|
205
|
-
| `c-level-skills` | 28 advisory skills (CEO/CFO/COO) | claude-code-skills | executive · full |
|
|
206
|
-
| `business-growth-skills` | Growth, finance, marketing playbooks | claude-code-skills | executive · full · growth-marketing |
|
|
207
|
-
| `finance-skills` | Financial models | claude-code-skills | executive · full |
|
|
208
|
-
| `pm-skills` | PM workflows | claude-code-skills | project-management |
|
|
209
|
-
| `product-skills` | Product discovery + delivery | claude-code-skills | project-management (dev tracks: opt-in since v26.106.0) |
|
|
210
|
-
| `marketing-skills` / `research-summarizer` | Marketing playbooks | claude-code-skills | growth-marketing |
|
|
211
|
-
|
|
212
|
-
### Dev Tools (all dev tracks)
|
|
213
|
-
|
|
214
|
-
| Asset | What | Source |
|
|
215
|
-
|---|---|---|
|
|
216
|
-
| `playwright-skill` | E2E test authoring with Playwright | testdino-hq |
|
|
217
|
-
| `find-skills` | Search and rank installed skills | vercel-labs |
|
|
218
|
-
| `agent-browser` | Browser automation CLI for agents | npm |
|
|
219
|
-
| `karpathy-coder` | Pre-commit quality gate hook | claude-code-skills |
|
|
220
|
-
| `code-review` | Multi-agent PR review with confidence scoring — **opt-in** (overlaps the default review agents) | Anthropic official |
|
|
221
|
-
| `multi-persona-review` ★ | Critique one artifact via 3-5 parallel personas → P0/P1/P2 fixes | this project (core) |
|
|
222
|
-
| `gap-analysis-e2e` ★ | Detect north-star / correctness / UX gaps, then benchmark how reference services solved each | this project (core) |
|
|
223
|
-
| `ultracode-service-audit` ★ | Multi-agent, adversarially-verified full-service audit (7 dimensions) → milestone roadmap | this project (core) |
|
|
224
|
-
|
|
225
|
-
> ★ **dev-method skills** — first-party (`official`) workflow methodology bundled with the harness. **Core on every dev track** (installed by default; uncheck at step 3 or `--without <id>` to skip). Repo-bundled templates — no external download. **Installs across all 4 CLIs**: Claude (`.claude/skills/`) and Codex / Antigravity as native skills (`.agents/skills/<id>/SKILL.md`), plus OpenCode as a command fallback (`.opencode/commands/<id>.md`, since OpenCode has no native skill concept).
|
|
226
|
-
|
|
227
|
-
### Workflow (opt-in — pick one or more at step 3)
|
|
228
|
-
|
|
229
|
-
> **Which one?** See the [Workflow curation guide](docs/WORKFLOWS.md) — a vetted comparison of all 7 installable workflows (plus honest pointers to Spec Kit / Kiro, which we recommend but don't auto-install).
|
|
230
|
-
|
|
231
|
-
| Asset | What | Activates |
|
|
232
|
-
|---|---|---|
|
|
233
|
-
| `superpowers` | Agentic skills framework, Anthropic official marketplace | obra/superpowers |
|
|
234
|
-
| `ecc-plugin` | 60 agents · 230 skills · 75 commands | affaan-m |
|
|
235
|
-
| `openspec` | Spec-driven brownfield delta workflow (propose → apply → archive) | Fission-AI |
|
|
236
|
-
| `bmad-method` | Multi-agent agile workflow (PM/Architect/Dev, 12+ agents) | bmad-code-org |
|
|
237
|
-
| `addy-agent-skills` | `/spec` `/plan` `/build` `/test` `/review` `/ship` `/code-simplify` skills | addyosmani's workflow |
|
|
238
|
-
| `wshobson-agents` | Multi-agent orchestration workflows (full-stack/tdd/review), cross-CLI | wshobson |
|
|
239
|
-
| `feature-dev` | Guided feature workflow — explore/architect/review agents | Anthropic official marketplace |
|
|
240
|
-
|
|
241
|
-
**First-party dev-method skills** — `official`, **core on every dev track** (installed by default; uncheck at step 3 or `--without <id>` to skip). Repo-bundled templates that install across all 4 CLIs: Claude, Codex/Antigravity native skills, OpenCode command fallback.
|
|
242
|
-
|
|
243
|
-
| Asset | What | Source |
|
|
244
|
-
|---|---|---|
|
|
245
|
-
| `asis-tobe-decision` ★ | Present an A-or-B / approval moment as context → recommendation → option table → AS-IS/TO-BE contrast | this project (core) |
|
|
246
|
-
| `compaction-handoff` ★ | Persist durable state + git snapshot + resume anchor before a context `/compact` | this project (core) |
|
|
247
|
-
| `northstar-roadmap` ★ | Measure current state vs the vision doc → ranked feature backlog persisted to docs/plans + memory | this project (core) |
|
|
248
|
-
| `harness-health-audit` ★ | Audit your CLAUDE.md/rules/skills/hooks on 4 questions a linter can't answer: TRUE · USED · AFFORDABLE · SAFE | this project (core) |
|
|
249
|
-
| `recurrence-prevention` ★ | When the same defect happens again: verify the count with evidence, classify simple slip vs complex problem, escalate record → forced rule → structural gate | this project (core) |
|
|
250
|
-
|
|
251
|
-
**First-party recommended means** (`official`, **opt-in** — the methodology above is core; these are *means* the maintainer recommends, not requirements. `--with model-orchestration` / `--with gemini-consult` / `--with codex-consult`; repo-bundled, install across all 4 CLIs; the two advisors need their external CLI at runtime — Antigravity [`agy`](https://antigravity.google/cli) or OpenAI `codex`):
|
|
252
|
-
|
|
253
|
-
| Asset | What | Source |
|
|
254
|
-
|---|---|---|
|
|
255
|
-
| `model-orchestration` | Model orchestration policy — role split (orchestrator directs/reviews · strong model authors core/V&V · mid model does repetitive impl/E2E) + effort floors + quota handoff | this project |
|
|
256
|
-
| `gemini-consult` | Consult Gemini (via `agy`) for natural **Korean** phrasing + **multi-persona** second-opinion review + image generation — an idiomatic, independent second model | this project |
|
|
257
|
-
| `codex-consult` | Consult OpenAI Codex (`codex exec`) for **concise / structured** rewriting + **image generation** (real PNG on disk) — division of labor: nuance/persona → gemini, concision/structure/images → codex | this project |
|
|
258
|
-
|
|
259
|
-
**First-party CI scaffold** (`official`, **opt-in** — `--with ci-scaffold`): `.github/workflows/` fill-in templates — tag-triggered CI + real-DB service container block + coverage gate + Playwright E2E — variant-matched to your tracks (node / python / both; E2E on UI tracks). The only asset that writes outside `.claude/`, so it **never overwrites existing workflow files** (they're reported as preserved), and uninstall leaves `.github/` untouched.
|
|
260
|
-
|
|
261
|
-
### Security & ECC (opt-in)
|
|
262
|
-
|
|
263
|
-
| Asset | What | Source |
|
|
264
|
-
|---|---|---|
|
|
265
|
-
| `security-guidance` | Pattern-based security warnings on every edit + LLM diff review (needs Python + Agent SDK at runtime) | Anthropic official |
|
|
266
|
-
| `trailofbits-skills` | Differential security review | Trail of Bits |
|
|
267
|
-
| `ecc-plugin` | ECC plugin (project-scoped via `prune-ecc.sh`) | affaan-m |
|
|
268
|
-
| `ecc-prune` | Trim ECC down to a curated set (4 agents + 8 skills + 3 commands) | this project |
|
|
70
|
+
Eleven tracks, grouped by what you're building:
|
|
269
71
|
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
72
|
+
- **Frontend + backend** — `csr-supabase` · `csr-fastify` · `csr-fastapi` · `ssr-nextjs` · `ssr-htmx`
|
|
73
|
+
- **Data** — `data`
|
|
74
|
+
- **Business** — `executive` · `project-management` · `growth-marketing`
|
|
75
|
+
- **Meta** — `tooling` (Bash and Markdown projects with no app stack)
|
|
76
|
+
- **Everything** — `full`
|
|
273
77
|
|
|
274
|
-
|
|
78
|
+
### [See what each track installs →](docs/TRACKS.md)
|
|
275
79
|
|
|
276
|
-
|
|
277
|
-
- **vetted** — community assets with ≥ 1000 GitHub stars and active maintenance. Pre-checked when they match your track.
|
|
278
|
-
- **⚠ experimental** — under 1000 stars. Opt-in only (not pre-checked), listed at the bottom of each category.
|
|
80
|
+
## Docs
|
|
279
81
|
|
|
280
|
-
|
|
82
|
+
### [Read the usage guide →](docs/USAGE.md)
|
|
281
83
|
|
|
282
|
-
|
|
84
|
+
Workflow detail, install internals, uninstall, scope, CI flags, and per-CLI setup.
|
|
283
85
|
|
|
284
|
-
|
|
86
|
+
### [Check the compatibility matrix →](docs/COMPATIBILITY.md)
|
|
285
87
|
|
|
286
|
-
|
|
88
|
+
Per-asset install method and verification status.
|
|
287
89
|
|
|
288
|
-
|
|
90
|
+
### [Browse the tracks →](docs/TRACKS.md)
|
|
289
91
|
|
|
290
|
-
|
|
291
|
-
|---|---|---|
|
|
292
|
-
| `claude plugin` | `--scope project` (entries isolated by `projectPath` in `installed_plugins.json`) | `--scope user` |
|
|
293
|
-
| `npx skills` | project `node_modules` | `-g` (user-level) |
|
|
294
|
-
| `npm` | `--save-dev` (devDependency) | `-g` |
|
|
295
|
-
| Codex (prompts / skills / config) | `.codex/` in your project | `~/.codex/` |
|
|
296
|
-
| Antigravity (skills / workflows) | `.agents/` in your project | `~/.gemini/antigravity/` |
|
|
297
|
-
| `~/.claude/skills/` · `~/.codex/` · `~/.opencode/` · `~/.gemini/` · `npm root -g` | **not touched** | written per asset |
|
|
92
|
+
What each track pre-checks, asset by asset.
|
|
298
93
|
|
|
299
|
-
|
|
94
|
+
### [Read the security notes →](SECURITY.md)
|
|
300
95
|
|
|
301
|
-
|
|
302
|
-
|
|
303
|
-
---
|
|
304
|
-
|
|
305
|
-
## Uninstall
|
|
306
|
-
|
|
307
|
-
```bash
|
|
308
|
-
npx -y @uzysjung/agent-harness uninstall
|
|
309
|
-
```
|
|
96
|
+
What vetting covers, what it doesn't, and how to report an issue.
|
|
310
97
|
|
|
311
|
-
|
|
312
|
-
|
|
313
|
-
- Project-scope assets: removed automatically (`claude plugin uninstall --scope project`, `npm uninstall --save-dev`, `.codex/` cleanup, etc.).
|
|
314
|
-
- Project root `CLAUDE.md`: removed only if it still matches the installed version (sha256); kept with a notice if you've edited it since install.
|
|
315
|
-
- Global-scope assets: listed as advisory only — you remove them yourself. Uninstall never touches another project or your global config without explicit action.
|
|
316
|
-
|
|
317
|
-
Flags:
|
|
318
|
-
|
|
319
|
-
| Flag | What |
|
|
320
|
-
|---|---|
|
|
321
|
-
| `--dry-run` | List reverse steps, change nothing |
|
|
322
|
-
| `--keep-templates` | Remove external assets but keep `.claude/`, `.codex/`, `.opencode/` |
|
|
323
|
-
|
|
324
|
-
---
|
|
325
|
-
|
|
326
|
-
## How it works
|
|
327
|
-
|
|
328
|
-
```
|
|
329
|
-
┌──────────────────────────────────────────────────────────┐
|
|
330
|
-
│ npx -y @uzysjung/agent-harness │
|
|
331
|
-
│ │ │
|
|
332
|
-
│ ▼ │
|
|
333
|
-
│ ┌─ 6-step wizard ──────────────────────────────────┐ │
|
|
334
|
-
│ │ Track(s) → CLI(s) → Items → Scope → Confirm │ │
|
|
335
|
-
│ └──────────────────┬───────────────────────────────┘ │
|
|
336
|
-
│ ▼ │
|
|
337
|
-
│ ┌─ Phase 1: Templates ─────────────────────────────┐ │
|
|
338
|
-
│ │ .claude/{rules,agents,hooks,commands,skills} │ │
|
|
339
|
-
│ │ CLAUDE.md (scaffold) · .mcp.json │ │
|
|
340
|
-
│ └──────────────────┬───────────────────────────────┘ │
|
|
341
|
-
│ ▼ │
|
|
342
|
-
│ ┌─ Phase 2: External assets ───────────────────────┐ │
|
|
343
|
-
│ │ claude plugin / npx skills / npm / shell-script │ │
|
|
344
|
-
│ │ Honors the scope chosen at step 4 │ │
|
|
345
|
-
│ └──────────────────┬───────────────────────────────┘ │
|
|
346
|
-
│ ▼ │
|
|
347
|
-
│ ┌─ Phase 3: install log ───────────────────────────┐ │
|
|
348
|
-
│ │ .claude/.harness-install.json │ │
|
|
349
|
-
│ │ (drives `uninstall`) │ │
|
|
350
|
-
│ └──────────────────────────────────────────────────┘ │
|
|
351
|
-
└──────────────────────────────────────────────────────────┘
|
|
352
|
-
```
|
|
353
|
-
|
|
354
|
-
After install, a `tooling` + Claude project looks like:
|
|
355
|
-
|
|
356
|
-
```
|
|
357
|
-
your-project/
|
|
358
|
-
├── .claude/
|
|
359
|
-
│ ├── rules/ # coding conventions for your stack
|
|
360
|
-
│ ├── agents/ # subagent definitions
|
|
361
|
-
│ ├── hooks/ # lifecycle / pre-commit hooks
|
|
362
|
-
│ └── settings.json # your existing one is backed up first
|
|
363
|
-
├── CLAUDE.md # fill-in scaffold (yours backed up if it differed)
|
|
364
|
-
└── .mcp.json # MCP servers, merged with yours
|
|
365
|
-
```
|
|
366
|
-
|
|
367
|
-
---
|
|
368
|
-
|
|
369
|
-
## CLI support
|
|
370
|
-
|
|
371
|
-
| CLI | Status |
|
|
372
|
-
|---|---|
|
|
373
|
-
| Claude Code | First class — all assets and hooks |
|
|
374
|
-
| Codex (OpenAI) | Skills + `AGENTS.md` rules for your stack |
|
|
375
|
-
| OpenCode | Skills + AGENTS.md integration |
|
|
376
|
-
| Antigravity (Google) | Project: `.agents/rules/` (context, always) + `.agents/skills/` (dev-method skills) |
|
|
377
|
-
|
|
378
|
-
Pick one or more at step 2.
|
|
379
|
-
|
|
380
|
-
---
|
|
381
|
-
|
|
382
|
-
## Advanced
|
|
383
|
-
|
|
384
|
-
- [docs/USAGE.md](./docs/USAGE.md) — workflow detail, install internals, CI flags, ECC integration, Codex/OpenCode setup
|
|
385
|
-
- [docs/NORTH_STAR.md](./docs/NORTH_STAR.md) — design principles
|
|
386
|
-
- [docs/decisions/](./docs/decisions/) — ADRs (architecture decisions)
|
|
387
|
-
- [docs/REFERENCE.md](./docs/REFERENCE.md) — per-track asset matrix in detail
|
|
388
|
-
|
|
389
|
-
---
|
|
98
|
+
Workflow bundles are compared in [docs/WORKFLOWS.md](docs/WORKFLOWS.md); design principles live in [docs/NORTH_STAR.md](docs/NORTH_STAR.md); architecture decisions in [docs/decisions/](docs/decisions/).
|
|
390
99
|
|
|
391
100
|
## License
|
|
392
101
|
|
package/dist/index.js
CHANGED
|
@@ -712,7 +712,7 @@ var cac = (name = "") => new CAC(name);
|
|
|
712
712
|
// package.json
|
|
713
713
|
var package_default = {
|
|
714
714
|
name: "@uzysjung/agent-harness",
|
|
715
|
-
version: "26.
|
|
715
|
+
version: "26.118.0",
|
|
716
716
|
description: "Curate vetted AI-coding skills & plugins by your tech stack \u2014 install only what you need, across Claude Code, Codex, OpenCode & Antigravity",
|
|
717
717
|
type: "module",
|
|
718
718
|
publishConfig: {
|