by Ancienttwo
File-backed workflow harness for reliable Claude Code and Codex sessions.
# Add to your Claude Code skills
git clone https://github.com/Ancienttwo/repo-harnessLast scanned: 7/15/2026
{
"issues": [
{
"file": "README.md",
"line": 258,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/instal\"",
"severity": "low"
}
],
"status": "PASSED",
"scannedAt": "2026-07-15T06:13:10.908Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}repo-harness is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Ancienttwo. File-backed workflow harness for reliable Claude Code and Codex sessions. It has 405 GitHub stars.
Yes. repo-harness passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/Ancienttwo/repo-harness" and add it to your Claude Code skills directory (see the Installation section above). repo-harness ships a SKILL.md manifest, so compatible agents can discover and load it automatically.
repo-harness is primarily written in TypeScript. It is open-source under Ancienttwo on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh repo-harness against similar tools.
No comments yet. Be the first to share your thoughts!
Use only for an explicit repo-harness action or an active task. Ordinary questions, reviews, explanations, plan discussion, and quoted historical text bypass it.
Start with:
repo-harness state resolve --json
Treat that JSON as the state authority; read Plan, Contract, checks, handoff, or architecture files only when it points to them.
repo-harness-setup; inspect first with repo-harness init --repo . --dry-run, or run repo-harness docs show harness-overview when detail is needed.repo-harness-plan; run repo-harness docs show agentic-development-flow for promotion boundaries.repo-harness-check; never infer provider-owned evidence.repo-harness run prepare-codex-handoff/codex-handoff-resume; see references/handoff.md. Inject references and deltas, not full copies.Safety boundaries (scope, worktree ownership, secrets, destructive commands, high-risk paths, checks freshness, review fingerprints) are deterministic and fail closed; a profile override may raise, never lower, the risk floor.
Command catalogs, scaffold presets, migration, deployment, hook debugging, and other integrations load on demand.
English | 简体中文 | 日本語 | Français | Español
Give the agent a complete PRD or Sprint; after that, your loop is just review and next, or start /goal and go AFK.
repo-harness ships a CLI plus skill/runtime hooks that write context, plans,
handoffs, checks, and review evidence back into the project, so the next agent
session continues from files instead of chat memory. It adopts an existing repo
with a tasks-first agent contract that keeps Claude and Codex aligned.
Prerequisites: a Git working tree, bash, and bun; jq is optional. No
Node.js required — the installer uses Bun >= 1.1.35 as the runtime, installing or
upgrading Bun first when needed.
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.sh | sh
# Windows (PowerShell)
irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 | iex
With Bun >= 1.1.35 already on PATH, skip the shell installer. Package-manager-owned
Bun installs fail closed with the matching upgrade command (brew upgrade bun)
instead of overwriting manager-owned files.
bunx repo-harness@latest install # Bun one-shot bootstrap
bun add -g repo-harness # or install the persistent CLI first
repo-harness install
npx -y repo-harness@latest install # npx fallback; the CLI still runs on Bun
repo-harness install
The global bootstrap: installs the npm package as the global CLI, refreshes
repo-harness skill aliases, installs user-level hook adapters, and records an
explicit install profile. It is idempotent and does not apply repo-local workflow
files to the current directory. --dry-run --json lists components to install,
skip, and remove first. Profiles, native Codex delegation authority, refresh commands, and the
read-only setup check audit:
install-profiles.md.
repo-harness init --dry-run
Run this from the target repository root. It reports the specs, task state,
helper runtime, hook adapter target, and verification files that would be created
or refreshed. It never creates an application stack; new projects and modules use
repo-harness-setup's scaffold mode instead.
repo-harness init
bash scripts/check-task-workflow.sh --strict
bun test
Apply ends with === Migration Report ===, naming where generated hook behavior
comes from, the user-level ~/.claude/settings.json and ~/.codex/hooks.json
adapter target, the repo-local surfaces created or refreshed, the
.ai/harness/scripts/* helper runtime, and an --- External Tooling ---
readiness block. Stable intent then lives in docs/spec.md, execution state in
plans/ and tasks/, resume state in .ai/harness/handoff/. If the dry run
looks wrong, stop and read
hook-operations.md first.
repo-harness update # reconcile CLI, mandatory deps, profile tooling, and CodeGraph
repo-harness update --check # read-only repair guidance, no writes
repo-harness uninstall # remove managed host adapters only
SessionStart injects the prior session's
resume packet, Stop writes the handoff, and each edit records a small journal
event. A session can end mid-task and the next one resumes the exact next step,
blockers, and changed files without re-deriving them.In an adopted repo, the surface area is intentionally small:
| Surface | Purpose |
|---|---|
docs/spec.md and docs/reference-configs/ |
Shared standards and stable product intent that every agent session can read. |
plans/, plans/prds/, and plans/sprints/ |
Decision-complete work packages before implementation starts. |
tasks/contracts/, tasks/reviews/, and .ai/harness/checks/ |
Scope, verification, and review evidence for proving the work is done. |
.ai/harness/handoff/ and tasks/current.md |
Session journal and resumable status, derived from workflow artifacts instead of chat memory. |
| File-backed sessions | Plans, contracts, checks, and handoffs live in the repo, so a new session resumes from artifacts instead of a chat thread |
| Typed hook runtime | Eight shared managed routes plus three Codex-only delegation routes, each bound to exactly one typed in-process handler, with fail-closed guards at the edit boundary |
| Plan → Contract → Review | One lifecycle from approved plan to projected contract, isolated worktree, structured evidence, and a reviewable closeout |
| Progressive context loading | A ~12KB stable root context plus ~1KB capability contracts loaded only for the files actually being touched |
| CodeGraph integration | Structural queries (callers, callees, definitions) answered from a pre-built index instead of repeated grep-and-read passes |
| MCP planner sidecar | ChatGPT reads real repo state and writes PRD/Sprint/Goal artifacts; Codex executes them, with no default source-code write access |
| Claude + Codex alignment | One user-level adapter contract, one workflow contract, and one set of repo-local artifacts shared by both hosts |
repo-harness init or migration writes repo-local
files such as docs/spec.md, plans/, tasks/, .ai/context/,
.ai/harness/, helper scripts, and .ai/hooks/.~/.claude/settings.json and
~/.codex/hooks.json route Claude/Codex events into repo-harness-hook.The hook entrypoint exits silently for non-opt-in repos. For opted-in repos, the
route registry binds the public event tuple to exactly one packaged typed
handler. .ai/hooks/ holds operator-helper projection only; it is never a
host-event dispatcher.
The core invariant is that durable truth lives in the repo, not a chat thread.
Hooks are accelerators and guardrails; authority remains the file-backed plan,
contract, review, checks, and handoff artifacts. Prompt-layer plan/spec/contract
gates are advisory routing; hard enforcement lives at the edit boundary. Handler
internals, the minimal-change surface, and policy modes:
hook-operations.md and
minimal-change-hooks.md.
The diagram assumes the harness is installed. It shows the normal lifecycle from a program sprint backlog down to one contract task: select the task, project it into execution files, check out the contract worktree when policy requires it, implement under hooks, verify, review, and close out.
flowchart TD
Program["Program goal or release theme"] --> Sprint{"Sprint layer needed?"}
Sprint -->|yes| PRD["Upper-layer PRD<br/>plans/prds/*.prd.md"]
PRD --> SprintDoc["Sprint backlog<br/>plans/sprints/*.sprint.md"]
SprintDoc --> NextTask["Select next sprint task<br/>sprint-backlog.sh next"]
Sprint -->|no| UserTask["User task or planning prompt"]
Heartbeat["Heartbeat triage<br/>scripts/heartbeat-triage.sh<br/>.ai/harness/triage/"] --> UserTask
NextTask --> UserTask
UserTask --> Discovery["Due diligence<br/>P1 map, P2 trace, P3 decision"]
Discovery --> LoopEvidence["Loop evidence when routing changes<br/>state-snapshot --json<br/>route-nl-vs-ts / cutover gate"]
LoopEvidence --> PlanDraft["Draft plan<br/>plans/plan-*.md"]
PlanDraft --> PlanReview{"Plan ready for execution?"}
PlanReview -->|no| Refine["Refine plan, scope, evidence contract"]
Refine --> PlanDraft
PlanReview -->|yes| Approve["Approved plan<br/>Status: Approved"]
Approve --> Project["Project plan into execution<br/>capture-plan.sh --execute<br/>or plan-