gaia: Command for Claude Code

.claude/commands/setup-gaia.md

setup-gaia is a command for Claude Code from gaia-react/gaia. It costs 72 tokens per session (9,375 once invoked), scanned B, original, MIT.

A repeatable setup command for a GAIA project, covering the tools, repository, continuous integration, and developer merge-check choices needed after initialization. It detects what is already done and runs only the remaining setup work.

In plain words
What is it for?
Use it after project initialization to install local tools, configure the GitHub repository and CI, choose audit mode, or reconfigure an existing setup.
Why use it?
It avoids repeated provisioning and makes it safe to resume or rerun project onboarding; a reconfigure option handles token rotation and tool selection changes.

Command for Claude Code

Written for Claude Code: disable-model-invocation in frontmatter. Also seen: reads .claude/ paths; mentions Claude Code.

This is gaia-react/gaia's own configuration. It tells Claude Code how to work on gaia itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything gaia configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is bash .gaia/scripts/link-worktree.sh.

Reuse

Borrowing it

Nothing to install: this file belongs to gaia-react/gaia. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/gaia-react/gaia/main/.claude/commands/setup-gaia.md
Clone the repo
git clone --depth 1 https://github.com/gaia-react/gaia

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for setup-gaia

README.md
[![agentmods](https://agentmods.dev/badge/commands/gaia-react/gaia/setup-gaia/github.svg)](https://agentmods.dev/commands/gaia-react/gaia/setup-gaia)
Your own site
<a href="https://agentmods.dev/commands/gaia-react/gaia/setup-gaia"><img src="https://agentmods.dev/badge/commands/gaia-react/gaia/setup-gaia/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for setup-gaia

Your own site · 80×15
<a href="https://agentmods.dev/commands/gaia-react/gaia/setup-gaia"><img src="https://agentmods.dev/badge/commands/gaia-react/gaia/setup-gaia.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 72 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 9,375 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe. ✓ AI security review Sonnet 5 · 7 Sept 2026 📄 Read the review
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00072 $0.09375
Opus 5.5 $0.00029 $0.03750
Sonnet 5.5 $0.00014 $0.01875
Haiku 4.5 $0.00007 $0.00937

Measured 4d ago against content hash 6a5f4d49f99c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

setup-gaia scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

GAIA's statusline (`.gaia/statusline/gaia-statusline.sh`) always draws GAIA's nudges on the right. For the left side it runs the developer's global `statusLine.command` from `~/.claude/settings.json` when one exists, oth
.claude/commands/setup-gaia.md · 477 lines

How it starts

The opening of the file, as written. The whole thing — 477 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Run this once after /gaia-init, and re-run it any time. /setup-gaia is the single onboarding command for a GAIA project. It detects the situation and runs only the phases this clone actually owes:

  • Per-machine work every clone needs (tool installs, plugins, statusline bit, .env, the sandbox decision, and, for a developer with a global statusline, which statusline draws the left side).
  • GitHub repository provisioning (create / adopt / manual, private by default), plus branch protection, the GAIA-Audit required-check registration, and squash-only merge settings when the runner is a repo admin.
  • Team settings in .gaia/project.json: the git isolation policy and the sandbox recommendation. Both ship with a default (worktrees always, sandbox not recommended), so a plain run records the default and asks nothing; a repo admin changes either with --reconfigure, where the admin's own sandbox answer sets the recommendation.

It is safe for any developer to run at any time. A phase is owed when its own gate says so, or when the shipped setup feature list (.gaia/setup-features.json) holds its feature with no recorded decision; each decision it makes is recorded. A plain (no-flag) re-run on a provisioned project whose decisions are all recorded prints the already-provisioned line and mutates nothing: it never re-provisions the repo or changes branch protection. The one exception is a repo admin re-running it on a repo whose required checks still lack GAIA-Audit (or still carry the stale code-review-audit context): that run owes the registration and makes it. Pass --reconfigure to re-ask the sandbox decision (Phase 2), whose answer from a repo admin also sets the team sandbox recommendation, the team git isolation policy (Phase 3.5), the squash-only-merge offer (Phase 3.7), and the statusline left-side choice (Phase 4.6).

Contents: Pre-flight: Worktree check; Argument parse; Phase 0: Prerequisites; Phase 1: Detect situation; Phase 2: Per-machine setup; Phase 3: GitHub repository; Phase 3.5: Team settings; Phase 3.7: Squash-only merges; Phase 4.5: Label sync; Phase 4.6: Statusline left side; Phase 5: Owed setup features; Phase 5.5: Land setup decisions; Phase 6: Finalize; Idempotence / re-run safety; On failure: re-run.

This command reads these references, all under .claude/skills/gaia/references/setup/. Read one only when a "Read ... now" line sends you there, and then read the whole file:

  • setup-decisions.md: Phase 1, every run, for the owed check and who may record project decisions.
  • sandbox.md: Phase 2, when the sandbox gate says the decision is owed, or to record a settled decision.
  • per-machine.md: Phase 0d, every run, for its ## Git hooks check; Phase 2, when completed_at is null or a per-machine id is owed.
  • github-repo.md: Phase 3, when no repo exists yet or its default branch is not pushed; Phase 3.5, for owed GitHub settings.
  • isolation-question.md: Phase 3.5, on --reconfigure once both gates pass.
  • sandbox-recommendation.md: Phase 3.5, on --reconfigure when Phase 2's sandbox answer did not set the recommendation.
  • squash-only.md: Phase 3.7, once both gates say the question is owed.
  • statusline-left.md: Phase 4.6, every invocation for the routing warning, and when a choice or record is owed.
  • standalone-features.md: Phase 5, every run.
  • migrate-2-machine.md: Phase 5, when standalone-features.md names it as owed.
  • land-decisions.md: Phase 5.5, to land project decisions, and Phase 6, for the setup ping and the closing message.

Pre-flight: Worktree check

This command does per-machine and per-clone provisioning, writes .gaia/local/setup-state.json, and provisions the GitHub repository. If invoked from a linked worktree, reject hard: gaia_refuse_if_worktree (.gaia/scripts/main-only-lib.sh) asks the shared resolver which tree this is and refuses out loud, naming the main checkout (the clone's primary working directory, on any branch), when the answer is a worktree.

Read the full file on GitHub · 477 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago Changed · -21 lines 6a5f4d49f99c
  2. 6d ago Changed · +5 lines 40ee42d350aa
  3. 9d ago Changed · +8 lines 1c6da25b4ef9
  4. 10d ago Changed · -4 lines 00c813c7fde1
  5. 11d ago Changed · -4 lines · +23 tokens per session 758abedbe35a
  6. 12d ago Changed · +6 lines 64fbdec479fb
  7. 14d ago Changed 3dea4d125534
  8. 15d ago Changed 1565e12073fe
  9. 16d ago Changed · +13 lines ab454244309a
  10. 17d ago First seen · 474 lines · 49 tokens per session scan B 8879d43d5dd5

Subscribe to this mod's changes

setup-gaia is a command published in the GitHub repository gaia-react/gaia (26 stars, last pushed 4d ago), licensed MIT. It adds 72 tokens to every session and 9,375 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.