harness-mods

harness-mods is the function-hooks layer of Agnostic-AI, the Claude Code harness Wes Sander runs every day and mirrors in public (the repository was called claude-harness until mid-September 2026; the mod now lives under engine/mods/harness-mods). It rebuilds four of that harness’s guard hooks as one mod: subagent model routing, secret redaction of tool results, measured subagent accounting and a read cache. A fifth guard, a context-window nudge, was removed on 26 September. Each guard runs in one of three modes you set in ~/.claude/mods/mods-config.json, so you can watch what it would do before you let it act. Version 0.1.0 is written for the author’s harness first; read Limitations before you install it.

What it does

• routing hooks agent.spawn. Its policy rewrites the requested model onto the harness’s capability graph, escalates an advisor one rung above its caller, caps top-tier spawns at three per session and denies a spawn that crosses a missing edge. When it rewrites, the parent’s Agent result carries one hidden line saying which model actually ran.
• secretRedaction scans every tool result, including nested MCP content, for ten credential shapes: Anthropic, OpenAI, Stripe live, GitHub, AWS, Slack and Google keys, private key blocks, JWTs and Postgres URLs with a password. Each match becomes <REDACTED:kind:length> before the model sees it, and a toast names the kind.
• subagentAccounting prices every spawn from a prior (17,000 tokens for the harness’s lean agent types, 60,000 otherwise, or the running median of that type’s last twenty runs) and settles it against measured usage when the subagent finishes. Since 29 September the overhead prior is measured from the spawn’s first step rather than its whole run. It never blocks anything.
• readCache answers the third identical whole-file read of an unchanged file from cache: Read without offset or limit, or a plain cat file, with size and mtime verified. The served result carries a note saying it is the cached copy. Any Edit, Write or shell command that writes clears the cache.

A /mods command prints the canary verdict, each guard’s mode and whether it armed, usage and counters (status), the classic-versus-mod comparison (shadow), the per-agent ledger (ledger) or how to switch back (rollback). The mod draws nothing of its own above the prompt: the band it had was removed on 18 September because the harness’s status line already shows the same heartbeat.

Install

Needs Claude Code 2.1.287 or later and claude-runtime, a second plugin from the same marketplace that reads the raw function-hook events and republishes them on runtime.emit. The README declares no minimum Claude Code version; the module pins its runtime check to 2.1.274 in lib/canary.mjs. harness-mods gets its usage, subagent and tool events from that bus, and its canary reports adapter-noun-missing when $.runtime is not there.

The marketplace, harness-mods, is a local one: its manifest sits in engine/mods of the repository, not at the root, so claude plugin marketplace add ucsandman/Agnostic-AI does not find it. Clone the repository and add the folder:

git clone https://github.com/ucsandman/Agnostic-AI
claude plugin marketplace add ./Agnostic-AI/engine/mods
claude plugin install claude-runtime@harness-mods
claude plugin install harness-mods@harness-mods

The author’s own route is npm run setup of the whole harness, which links ~/.claude/mods to that folder and registers the marketplace in settings.json; the commands above add the same local marketplace by hand. Run /mods to see the canary and the modes. Without a config file every guard is in shadow_mod. To let a guard act, write its mode in ~/.claude/mods/mods-config.json:

{
  "version": 1,
  "guards": {
    "routing": "shadow_mod",
    "secretRedaction": "mod",
    "subagentAccounting": "shadow_mod",
    "readCache": "shadow_mod"
  }
}

HARNESS_MOD_ROUTING=classic in the environment overrides one guard for a session; HARNESS_MODS=off forces every guard to classic.

How it works

The three modes describe who owns a decision. In classic, the harness’s original hook (a .cjs script wired in settings.json) enforces and the mod only observes. In shadow_mod, the classic hook still enforces while the mod computes what it would have done and writes one comparison row per decision, so the two sides can be joined and graded for agreement. In mod, the mod enforces and the classic hook stands down, but only for a session in which the mod’s heartbeat says that guard armed; a mod that failed to load can never leave a decision unowned. If you do not run the rest of claude-harness, there is no classic hook: classic and shadow_mod enforce nothing, and only mod changes what Claude Code does.

The mod hooks two raw events where it must intercept: agent.spawn for routing, and tool.call for redaction, the read cache and the routing explanation. prompt.submit only refreshes the session heartbeat. Per-step subagent usage, completions and usage changes arrive on runtime.emit from claude-runtime. turn.complete on the main loop rewrites the heartbeat and flushes the shadow rows. The canary grades the layer at every heartbeat: adapter reachable, nine expected runtime capabilities present, session usage and plugin store working, no hook errors, events flowing, and harness-mods loaded beneath claude-runtime.

State goes under ~/.claude/mods/state/: sessions/<id>.json (the heartbeat), canary-status.json, shadow/<id>.mod.jsonl (comparison rows), subagents.jsonl (one settled row per subagent) and redactions.jsonl, which records the kind and count of each hit and never the value. Learned priors live in the plugin store under harness-mods.ledger across sessions. The mod makes no network calls and no model calls.

Tokens are only spent when a guard acts: one hidden context line of at most 320 characters per rewrite, redaction or cached read. If you want only the redaction as a standalone mod, secret-redactor covers it. The overall shape, one person’s harness guards moved into a mod with a shadow phase first, is close to catalyst-probes.

Limitations

• Paths are resolved, not hardcoded, since 19 September. The module reads CLAUDE_CONFIG_DIR, else USERPROFILE or HOME plus /.claude, on its first event. When none of them is set, every path stays empty, the mod reads no config, so each guard stays in shadow_mod, and its heartbeat, shadow rows and logs fail quietly. The earlier release hardcoded the author’s Windows home.
• The routing policy encodes the harness’s own model ladder and its advisor escalation, so outside that harness a rewrite follows rules you did not write. Read hooks/lib/routing.mjs before setting routing to mod.
• classic and shadow_mod only compare against classic hooks you have installed from the harness. Alone, the mod is useful in mod mode or as an observer.
• The capability probe is pinned to 2.1.274. A patch release is a warning; a minor release fails the version check until the author repins. On a runtime that reports a different capability set the canary shows failures and subagentAccounting does not arm. No tested version is stated.
• Terminal only, in that the harness’s status line is where the heartbeat shows; the guards themselves run wherever the hooks run.