GitHub - hamza-ali-shahjahan/hamzaish: Open-source agent OS for Claude Code that puts you in Builder Mode — and keeps you there for the whole life of a product. Claude Code setup that builds, launches, and learns. Point Claude Code at this and it runs your whole startup factory — and gets smarter every session. Works with Cursor, Codex & Windsurf too.

See it work

Unlock your Builder Mode. Shipped through it so far: 6 products with public artifacts — live sites, npm CLIs, OSS tools → the showcase.

What this is

Hamzaish is an open-source agent OS for Claude Code that puts you in Builder Mode — and keeps you there for the whole life of a product. Your agent supplies the hands — the model, the sessions, the code. Hamzaish supplies everything that makes those hands a company: a brain that carries every ship's lessons into the next one, a factory of stage agents and playbooks for the whole product life — Ideate → MVP → Launch → Sell → Scale → Kill-or-double-down — and a judge: mechanical verification gates, walled off from the builder, that refuse to let "looks done" pass for "done." That last part is the line between Builder Mode and vibe coding, and it's the part the factory is evolving hardest: an honest, automated, blind judge for everything it builds.

One deliberate architectural choice, stated plainly so you're not surprised when you clone: Hamzaish ships no agent loop and no model of its own. It is driven by an agent host — Claude Code today — that reads the skills, spawns the sessions, and executes. That's not a missing feature; it's the design. The factory is the part that compounds and stays yours; the engine underneath is swappable. Your host will be replaced by a better one within a year — your brain, your guardrails, and your judge shouldn't be.

→ The full mission: Builder Mode · The philosophy · Where it's evolving

The 11pm moment

Most AI tools stop when the code is done. Builders' problems start there.

The old advice — business plan, market sizing, twenty validation interviews before you build — was written for a world where building was expensive. That world is gone. Building is cheap, fast, and reversible now, which means the thing you ship is the test. Strategy-first kills more builders than bad ideas ever did — so here it's a rail you pull in when you want it, never a toll you pay to start.

But most solo projects don't die in the build. They die in everything after it: the security review, the launch, the pricing call, the first-100-customers grind, knowing when to kill. That's the part Hamzaish runs with you — and the reason it's a lifecycle, not a scaffolder.

What you get / what you bring

What you get — the factory, the brain, and the judge:

• The factory: 35 stage agents + 65 skills & commands (42 skills, 23 commands) covering the full lifecycle — idea validation, scaffolding, the eval-gated /full-cycle build engine, security review, go-live provisioning, launch, pricing, first-100-customers, retention, kill-or-double-down. Plus 50 playbooks and a 146-practice ledger where every practice is badged honestly: ✅ proven by a real ship or dated incident (44) · 🟡 partial (3) · ⏳ research-baked (99). No practice gets "proven" by opinion.
• The brain: learnings, decisions, and anti-patterns in markdown, SQLite-indexed, searchable from any session via /brain-ask. When a mistake generalizes, it's promoted into a guardrail the next build inherits automatically — your second product starts smarter than your first.
• The judge — mechanical gates, runnable today:
  • bun run eval — the eval harness: deterministic, agent-blind cases per skill (--no-llm needs no model or key). The coverage ratchet (bun run check-evals) enforces "a new skill without an eval is debt": 9 of 77 skills/agents carry cases today, the other 68 are a visible, grandfathered backlog — coverage can only go up, and deleting a case fails CI. Early and honest about it: the judge covers a handful of skills, not yet every build, and the direction is fixed.
  • bun scripts/verify-live.ts <url> — the go-live proof: read-only A1–A11 assertions against the real deployed product (DNS, TLS on apex + www, health endpoint, build-SHA match, authz on protected routes, cron-secret enforcement, Sentry canary). A scorecard, never a bare "done."
  • /security-check — the 70-check pre-launch security review with a forced BLOCK / CLEAR verdict.
  • The fact guards CI runs on every change — check-counts (every headline number in this README must match the filesystem or the build fails), check-evals, check-model-independence, check-product-layout, check-skill-command-collision, and friends. The honesty is enforced, not promised.

What you bring — the agent host:

Hamzaish runs on Claude Code (paid plan) + Bun, with the GitHub CLI for git-facing skills. bun run setup wires the skills for auto-discovery, and you drive the factory as slash commands — /builder-mode, /full-cycle, /go-live, /ship.

The brain and playbooks also travel to Cursor, Codex, and Windsurf via AGENTS.md — those hosts read the same markdown as context and follow it. Honest scope of that today: context-level, not a packaged plug-in — no slash-command ergonomics or auto-discovery outside Claude Code yet. The judge, though, is host-agnostic already: every gate script runs under bun regardless of which agent produced the work. Verification that doesn't care who built it is the point.

Install

Option A — the full factory (recommended: this is the compounding OS — clone it, it becomes yours)

One command; installs Bun if missing, clones, sets up (read it first):

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

git clone https://github.com/hamza-ali-shahjahan/hamzaish.git
cd hamzaish
bun run setup        # idempotent — creates YOUR factory, never touches existing data

Option B — just the plugins (pieces of Hamzaish in your own repo, no adoption — the free sample, not the product)

claude plugin marketplace add hamza-ali-shahjahan/hamzaish

claude plugin install repo-scout@hamzaish

Also available: web-launch@hamzaish · repo-scout standalone →

Requirements: Claude Code on a paid Claude plan (no free tier — better to know now) · Bun · GitHub CLI for the git-facing skills.

Quickstart — install to a green gate run

# after install: prove the headline numbers in this README match the filesystem
bun run check-counts

# run the judge — deterministic eval cases, no model or API key needed
bun run ingest
bun run eval --no-llm

# run the coverage + structure guards CI runs
bun run check-evals
bun run check-model-independence
bun run check-product-layout
bun run check-skill-command-collision

Green looks like: ✓ all headline counts match disk, an eval summary of PASS=16 SKIP=9 (SKIPs are LLM-only cases held out by --no-llm), and silent exit-0 from each guard. You've now watched the factory verify itself — before building anything with it, which is exactly the order Builder Mode runs in.

Then build — open Claude Code in the folder and type:

/builder-mode <your idea>

Watch it scaffold a local-first product that runs in 60 seconds. Local is mile one, not the destination: when you're ready, /go-live wires the accounts you set up once (Supabase, Stripe, Resend, your domain…), /security-check gates it, and /ship puts it live on a URL you can share. (The 10-minute guided version →)

Day-to-day: /work-on <slug> enters a product's workspace · /portfolio-pulse answers "where should I focus today" · /repo-scout <url> studies any repo without being changed by it.

Never used a terminal? You can absolutely do this — no coding required; you talk to an AI and it does the techie parts. → The complete click-by-click walkthrough (🍎 Mac · 🐧 Linux · 🪟 Windows).

Safety, either door: scaffolded products run agent-generated code inside a devcontainer, secrets are gitignored from commit zero, and nothing auto-pushes off your machine. (Full threat model →)

Why it rides on a host instead of being one

Because the host is the commodity and the factory is the compounding asset. Models get replaced; agent frameworks get replaced; the lessons from your last four ships, the guardrail that caught the auth bug that passed 138 tests, and the judge that won't let a launch through unverified — those compound for as long as you build. Hamzaish keeps that layer independent so it can ride each generation of agent rather than die with one. It's the verification-and-memory layer for whatever builds next — not a walled tool you have to move into.

What's inside

Every count real, every item linked, every claim badged. The full catalog, expanded:

How it's different

Not another AI coding setup. AI already writes your code — nobody's running your launch, your pricing, your first hundred customers, or the kill-call. Here's where Hamzaish actually sits:

The discipline

1. Build is the default — validate before irreversible bets. Cheap, fast, reversible ships are validation. Before expensive moves: ~5 target-profile conversations. The hard rule: never skip it silently — bun run check-validation <slug> records the debt.
2. Scope is the moat. Every product's scope.md says what it does AND deliberately doesn't.
3. Persistent context. Every product gets a CLAUDE.md; every decision is logged in decisions/.
4. Measurement before launch. North-star, activation, retention — defined before the first user.
5. The factory is a product. If it can't ship product #1 through, fix the factory before adding slots.
6. Honest copy. Every outward-facing word is true and verifiable when it ships; aspiration is labelled, never present-tense. Proven vs. promising is tracked in the honest ledger.

The self-improvement loop

Every working session appends learnings to brain/learnings/. At major-cycle boundaries, /learn-loop scores candidates on five axes (rubric) and promotes only the top few into load-bearing guardrails — a skill rule, a playbook step, an anti-pattern, a line in the practices ledger. Quarterly, /kill-or-keep runs on Hamzaish itself and re-checks each promoted guardrail: deliver the predicted gain, or get sunset. The factory compounds; it doesn't ossify.

Architecture

brain/        — identity, principles, learnings, anti-patterns, decisions, ingested knowledge
factory/      — agents (idea/ mvp/ launch/ scale/ portfolio/), skills, commands, playbooks
products/     — one folder per product: metadata + learnings ONLY (code stays in private repos)
meta/         — changelog, retros, evals, the self-improvement loop
stack/        — tech defaults + the set-up-once accounts guide
templates/    — Next.js starter + doc templates

Product code is never in this repo — only metadata and learnings. Your code (the moat) stays private; locations are wired via a git-ignored code-paths.local.json. So the repo is safe to share without exposing anyone's secret sauce. (the public/private boundary →)

Go deeper

Start here — total beginner · Your first product in 10 minutes · FAQ · Architecture · Philosophy · Where it's heading · Security model · Contributing · Changelog · repo-scout standalone

The backbone is hard-won venture experience — the Business-SWAT roles, opportunities, and mentors that came with years at Disrupt.com, taking things from zero to one before AI made building cheap. On that foundation, the patterns studied and credited — Addy Osmani's spec→ship discipline, Karpathy's eval-driven flywheel, gbrain (knowledge graph), Anthropic's Founder's Playbook (lifecycle framing), hermes-agent (self-improving skills), openclaw (multi-channel gateway), and ponytail (multi-agent portability) — sharpened that instinct and 10×'d the AI and agentic-building learning on top of it. The 2026-07 four-repo study — Graft (NanoNets), Adrian (Secure Agentics), AgentENV (kvcache-ai), and OpenSpace (HKUDS) — continued the pattern: two of its ideas became bun run skill-report and the eval judge's untrusted-output boundary, credited in references/README.md and ACKNOWLEDGMENTS.md. Study material lives in references/, never imported.

License

TL;DR — free for builders. Don't take it closed-source and sell it. Commercial license on request.

AGPL-3.0 — clean, no added clauses; see LICENSE. Copyright © 2026 Hamza Ali.

In plain English: use, study, modify, and self-host freely. If you run a modified version as a network service, your source must be AGPL too — the factory stays open for solo builders; nobody quietly turns it into a closed product. Commercial license available for closed-source use — contact below.