Borrowing it
Nothing to install: this file belongs to Everyone-Needs-A-Copilot/claude-copilot. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Everyone-Needs-A-Copilot/claude-copilot/main/.claude/commands/update-copilot.mdgit clone --depth 1 https://github.com/Everyone-Needs-A-Copilot/claude-copilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/everyone-needs-a-copilot/claude-copilot/update-copilot)<a href="https://agentmods.dev/commands/everyone-needs-a-copilot/claude-copilot/update-copilot"><img src="https://agentmods.dev/badge/commands/everyone-needs-a-copilot/claude-copilot/update-copilot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/everyone-needs-a-copilot/claude-copilot/update-copilot"><img src="https://agentmods.dev/badge/commands/everyone-needs-a-copilot/claude-copilot/update-copilot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01352 |
| Opus 5.5 | $0.00000 | $0.00541 |
| Sonnet 5.5 | $0.00000 | $0.00270 |
| Haiku 4.5 | $0.00000 | $0.00135 |
Grade A, and why
update-copilot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 225 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Update Claude Copilot
Update Claude Copilot to the latest version. This pulls the latest code and reinstalls the CLIs.
Step 1: Check Current Version
cd ~/.claude/copilot
OLD_VERSION=$(cat VERSION.json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('framework','unknown'))" 2>/dev/null || echo "unknown")
echo "Current version: $OLD_VERSION"
git log --oneline -1
Store the OLD_VERSION for comparison.
Step 2: Pull Latest Updates
Tell user: "Pulling latest Claude Copilot updates..."
cd ~/.claude/copilot && git pull origin main
If pull fails:
Tell user:
Pull failed
There may be local changes or network issues. Try:
cd ~/.claude/copilot
git status
git stash # if you have local changes
git pull origin main
git stash pop # restore local changes
Then STOP.
Step 3: Check New Version
cd ~/.claude/copilot
NEW_VERSION=$(cat VERSION.json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('framework','unknown'))" 2>/dev/null || echo "unknown")
echo "New version: $NEW_VERSION"
git log --oneline -1
git fetch --quiet --tags origin 2>/dev/null || true
if ! git rev-parse -q --verify "refs/tags/v${NEW_VERSION}" >/dev/null; then
echo "WARNING: v${NEW_VERSION} is untagged; updated projects fail FF12 until scripts/tag-release.sh runs."
fi
Compare with OLD_VERSION. If same, tell user "Source is already up to date" and continue to Step 4: the content-addressed installer is idempotent and also repairs a stale shim or machine-command deployment.
Step 4: Install the Exact Immutable Runtime
Tell user: "Installing the exact framework snapshot, cc CLI, and global commands..."
COPILOT_SOURCE_ROOT="$(git -C "$HOME/.claude/copilot" rev-parse --show-toplevel)"
COPILOT_SOURCE_COMMIT="$(git -C "$COPILOT_SOURCE_ROOT" rev-parse HEAD)"
COPILOT_SOURCE_TREE="$(git -C "$COPILOT_SOURCE_ROOT" rev-parse "$COPILOT_SOURCE_COMMIT^{tree}")"
python3 "$COPILOT_SOURCE_ROOT/scripts/install-framework-snapshot.py" \
--source-root "$COPILOT_SOURCE_ROOT" \
--source-commit "$COPILOT_SOURCE_COMMIT" \
--source-tree "$COPILOT_SOURCE_TREE"
export PATH="$HOME/.local/bin:$PATH"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed b2322a7a7bb7
- 15d ago Changed · +4 lines 63557d4326bc
- 1mo ago First seen · 221 lines · 0 tokens per session scan A e0cb40513ce1
update-copilot is a command published in the GitHub repository Everyone-Needs-A-Copilot/claude-copilot (14 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,352 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other commands, from other repositories
instinct-import
Import a portable YAML instinct pack with confidence-gated merge (Instinct Engine).
catchup
Restore context after /clear by summarizing recent work and project state.
recap
Time-windowed "where was I?" — git commits, session notes, and files touched in the last N hours or days. Use after stepping away for a few hours or days. Not for cold starts after a long absence (use /tools:brief) or live development checks (use /tools:status).
checkpoint
A checkpoint workflow that records project progress so work can be resumed after the conversation context is cleared. It combines verification, a Git commit, progress notes, and saved session information.
status
Warm mid-session check — git detail, last session note, and in-progress backlog. Use when you still have mental context loaded and want a quick pulse. Not for cold starts (use /tools:brief) or planning (use /tools:overview).
workday-complete
End-of-day wrap — validate, consolidate, review, changelog.