Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/deepfusionlabs/deep-init/plugin-updategit clone --depth 1 https://github.com/deepfusionlabs/deep-initWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.01021 |
| Opus 5 | $0.00018 | $0.00511 |
| Sonnet 5 | $0.00007 | $0.00204 |
| Haiku 4.5 | $0.00004 | $0.00102 |
Grade A, and why
plugin-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 34 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bring the running DeepInit up to date. Claude Code has no first-party "pull the latest plugin" command — the request (anthropics/claude-code#38271) was closed as not-planned, so this command IS that flow. Do this:
-
Detect the install kind:
- Marketplace install (the plugin loads from
~/.claude/plugins/) → go to step 2. - Local clone (you're running this repo's
skills/deep-init/directly) → there is nothing to fetch; skip to step 4 (a reload just picks up your local edits).
- Marketplace install (the plugin loads from
-
Detect your host first — it changes BOTH how you update and how you activate. Read your runtime host from your system context (e.g. a note that you're "running inside a VSCode native extension environment"), then follow only the matching block. Resolve the target
deep-init@<marketplace>— read the marketplace alias from the installed plugin state under~/.claude/plugins/, else fall back to thenamein.claude-plugin/marketplace.json.- VS Code / JetBrains extension → the chat panel does not shell out and the
claudeCLI is not on its PATH, so do not present a bare-shellclaude plugin updatehere. Update through the in-extension UI: open the/pluginmanager → Plugins tab → selectdeep-init→ Update / reinstall. - Plain terminal / CLI → refresh the catalog FIRST, then update, in the shell:
Refresh first, or the update quietly does nothing: if the catalog isn't refreshed,/plugin marketplace update <marketplace> # refresh the catalog so the newest version is visible claude plugin update deep-init@<marketplace> # pull the newest to disk (reversible; updates installed_plugins.json)claude plugin updatecompares against the stale advertised version, treats the old one as newest, and silently no-ops with no error — you'll believe it updated when nothing changed. If it reports "nothing to update" but the version didn't move, re-run themarketplace updateand try again. - Desktop app / web → there's no shell either; update through the
/pluginmanager (selectdeep-init→ Update / reinstall), same as the extension.
- VS Code / JetBrains extension → the chat panel does not shell out and the
-
Confirm before changing anything. State exactly what will run and that it changes host plugin state (not your repo, not git, reversible). Then WAIT for an explicit yes — never run it on assumption. On yes, perform the update for the detected host — run
claude plugin update deep-init@<marketplace>via the shell only in the plain terminal; in every other host drive the/pluginUI — and report the old → new version. -
Activate it — the one step left for you (a command can't self-invoke a reload). The update pulled the new version to disk; it is staged but not yet running, because Claude Code loads plugin markdown ONCE per session. Your single remaining action depends on your host:
- Plain terminal / CLI → run
/reload-plugins, or (more reliable for a command/version flip) start a new session. A reload picks up skills and hooks but does not rebuild the slash-command index (#37862), so the version canary may not flip from it — a new session is the sure path. - VS Code / JetBrains extension → restart the IDE itself — a full quit + reopen.
Developer: Reload Windowdoes not reload the plugin host (nor does opening a new chat in the same window), so the freshly-updated version stays invisible until a true app restart. - Desktop app / web → fully restart the app (or reload the session) — a window reload alone is not enough.
- Plain terminal / CLI → run
-
Confirm it flipped. After you reload/restart, run
/deep-init:version— the LOADED line should now equal the on-disk version (it reports what's actually running, so it's the honest check that activation worked).
For a full active-vs-installed-vs-newest diagnosis across every plugin (and duplicate-shadow detection), /oss-kit:oss-plugin-doctor owns that.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 34 lines · 37 tokens per session scan A c8aba32bcd90
plugin-update is a command published in the GitHub repository deepfusionlabs/deep-init (6 stars, last pushed 12d ago), licensed MIT. It adds 37 tokens to every session and 1,021 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
fleet-conformance
Scan every repo on the machine for guardrails, testing, and observability conformance; audit the deltas semantically; produce a fleet report; and propose canary-first remediation.
claude-md-migrate
Rewrite a bloated or stale CLAUDE.md into a lean, verified "map, not wishes" file — nothing invented, hard rules preserved verbatim.
claude-md-new
Scaffold a CLAUDE.md for this repo from battle-tested templates, filled in with the project's real commands.
implement-review
One agent implements a task, then reviews its own work behind a hard verification gate before finalizing.
project-init
Stand up the context layers for a project — a thin pointer-style AGENTS.md plus seed compass maps — without touching the memory layer.
claude-md-audit
Grade this repo's CLAUDE.md / AGENTS.md (0–100) and return a worst-first fix list.