modsforClaude

harness-ops

Reviewed at commit 9519cda

Caution: Starts unattended background Claude Code sessions in auto permission mode, with permission prompts turned off on newer versions, when you run /lanes start or restart.

Sends data to GitHub (api.github.com) through your gh CLI, only when you use lanes, morning-brief, known-issues create or changelog apply

Claude Code operations: audit-skill-visibility (skills the listing budget hides), inventory (all commands, skills, agents, tools, plugins)…

Source
github.com/melodic-software/claude-code-plugins/tree/main/plugins/harness-ops
Made by
Melodic Software
Pinned commit
9519cdae8db7003c57e27e2fe123d4634ac1f742
What we checked

Adds about sixteen Claude Code maintenance skills (inventories, audits, telemetry reports, plugin updates, background loop sessions) plus small hooks. By default the hooks log which skills you use to .claude/observability in your project and warn when another plugin's hook failed silently; a full per-session event log is off. Skills read ~/.claude, call GitHub through gh and fetch Claude docs when you run them.

Review details

Static review of the source at the pinned commit; not run. Command hooks in hooks.json, launched through node exec-bash.mjs (which resolves a real bash and spawns the plugin's own script): StopFailure, ConfigChange, InstructionsLoaded, PermissionDenied, PreCompact, PostToolUseFailure (Write|Edit|Bash) and UserPromptExpansion go to audit-event-emitter.sh, PostToolUse (Skill) to skill-usage-audit.sh, Stop to hook-failure-audit.sh, SessionStart to prerequisites.sh/.ps1 (only prints a notice when node is missing; PowerShell runs with -ExecutionPolicy Bypass on its own script). The telemetry rows only emit when you set HOOK_TELEMETRY_SINK to a local executable and then capture event types, tool names, the first word of a Bash command and repo-relative file names, never command bodies or error text. The skill-usage rows always (default on, switchable) append skill name, branch and project name to <project>/.claude/observability/skill-usage.jsonl and add that folder to .git/info/exclude (option; scopes user and data-dir available). hook-failure-audit.sh reads the session transcript for hook_non_blocking_error records, keeps a byte cursor and warned-hook markers in the plugin data directory (pruned after 7 days) and shows a systemMessage. The function-hook module register.ts registers nothing unless session_event_log_enabled is set (default off); then it hooks 28 classic.* events and runs session-event-log.sh through $.process.run to append one JSON line per event to <project>/.observability/claude/sessions, with prompt and message content only when session_event_log_content is also on, and session-retention.sh at SessionEnd deletes old session files of its own or hands them to a user-configured pre-prune command (bash -c, detached). Skills (user- or model-invoked, scripts read fully where they touch processes, network or settings, the rest by targeted search): lanes (user-only) runs git pull --ff-only, claude plugin marketplace update and claude --bg -n <lane> --permission-mode auto [--permission-prompts none], can run claude --cloud, and posts lane telemetry comments to an issue in your repo with gh api; it only prints scheduler entries (schtasks, cron) for you to register. plugins sync (user-only) runs claude plugin update/install/enable per the install_new option (default ask) and reorders enabledPlugins keys in ~/.claude/settings.json, refusing any change other than key order. behavior-probes live mode (opt-in, dry run by default) runs claude -p in temporary directories with a budget cap and passes ANTHROPIC_API_KEY/CLAUDE_CODE_OAUTH_TOKEN through to that child. known-issues reads GitHub issues with gh and files one with gh issue create (default anthropics/claude-code) only after an explicit yes; changelog apply opens PRs; morning-brief reads issues and PRs through gh with only its own script pre-approved; observability reads a local OTEL collector on 127.0.0.1, prunes its own stores and its context suggests npx -y ccusage (unpinned, not pre-approved, so Claude asks). fetch-docs.sh/docs-cache.sh download code.claude.com and platform.claude.com docs with curl. audit-install-state lists ~/.claude and marks .credentials.json as never opened. Generated HTML views talk only to a 127.0.0.1 bridge. Not reviewed: the Python audit scripts and test files beyond targeted search (several were truncated in the bundle and checked in the clone by grep), external CLIs (claude, gh, jq, git, ccusage) and the gh-api/telemetry formats.

What it uses
  • Reads your prompts: yes
  • Sees tool calls: yes
  • Blocks or changes tool calls: no
  • Reads or writes files: yes
  • Runs programs on your machine: yes
  • Calls the model (uses tokens): yes
  • Sends data over the network: yes
  • Stores data: yes
  • Shows something on screen: yes
Hooked events

Claude Code operations: audit-skill-visibility (skills the listing budget hides), inventory (all commands, skills, agents, tools, plugins), audit-install-state (~/.claude), audit-performance (slowness), audit-native-overlap (skills duplicating built-ins), observability (telemetry), known-issues (Claude bugs, status), changelog, behavior-probes, prerequisites, check, machine-profile, plugins (update the fleet), morning-brief, lanes (background loop sessions), setup. Plus opt-in hook event logs.

Made this mod? Add a badge to your README

modsforClaude badge for harness-ops

Paste this into your README. The badge says reviewed once the current version has been reviewed, and links readers to this page.

[![Listed on modsforClaude](https://modsforclaude.com/badge/harness-ops.svg)](https://modsforclaude.com/mods/harness-ops/)

← All mods