Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/gosha70/code-copilot-teamnpx agentmods add commands/gosha70/code-copilot-team/publish-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/gosha70/code-copilot-team/publish-pack)<a href="https://agentmods.dev/commands/gosha70/code-copilot-team/publish-pack"><img src="https://agentmods.dev/badge/commands/gosha70/code-copilot-team/publish-pack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/gosha70/code-copilot-team/publish-pack"><img src="https://agentmods.dev/badge/commands/gosha70/code-copilot-team/publish-pack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00404 |
| Opus 5.5 | $0.00000 | $0.00162 |
| Sonnet 5.5 | $0.00000 | $0.00081 |
| Haiku 4.5 | $0.00000 | $0.00040 |
Grade A, and why
publish-pack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
/publish-pack
Cut a coordinated release to Maven Central + PyPI.
Pre-release checklist
-
content/manifest.yamlversionbumped per SemVer (major if entries removed/renamed, minor if additive, patch otherwise). - Both wrappers' test suites pass on
master/main. - CHANGELOG (or release notes) updated with the same version.
- License-data file in
content/reviewed if sources changed. - Required secrets configured in the GitHub repo:
SIGNING_KEY,SIGNING_PASSWORD,OSSRH_USERNAME,OSSRH_TOKEN, and PyPI trusted publishing ORPYPI_TOKEN.
Cut the release
# Tag the release (must match content/manifest.yaml)
v=$(awk -F': *' '/^version:/ { gsub(/"/, "", $2); print $2; exit }' content/manifest.yaml)
git tag -a "v$v" -m "Release v$v"
git push origin "v$v"
The pack-publish.yml workflow:
- preflight — verifies the tag matches
content/manifest.yaml. - publish-jvm — builds, signs, and publishes to Maven Central (skipped with a notice if
SIGNING_KEYis empty). - publish-pypi — builds sdist + wheel, publishes via PyPI trusted publishing.
If either publish step fails, do not retag with the same version — bump patch and retry. Maven Central rejects re-publishes of the same coordinates; PyPI yanks but does not allow overwrites.
Local dry run
bash scripts/publish.sh
Uses publishToMavenLocal for the JVM side so you can verify artifact shape without touching Central. PyPI side requires PYPI_TOKEN or it will prompt.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 37 lines · 0 tokens per session scan A b496ef9924be
publish-pack is a command published in the GitHub repository gosha70/code-copilot-team (7 stars, last pushed 17d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 404 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
swarm-init
Initialize a Claude Flow swarm with specified topology and configuration.
release-update
(dev-only) release-update maintainer harness — Claude Code upstream change tracker (release-notes version-delta sweep + docs sync). NOT distributed to user projects.
release-swarm
Orchestrate complex software releases using AI swarms that handle everything from changelog generation to multi-platform deployment.
release-manager
Automated release coordination and deployment with ruv-swarm orchestration for seamless version management, testing, and deployment across multiple packages.
sync-coordinator
Multi-package synchronization and version alignment with ruv-swarm coordination for seamless integration between claude-code-flow and ruv-swarm packages.
github-modes
This document describes all GitHub integration modes available in Claude-Flow with ruv-swarm coordination. Each mode is optimized for specific GitHub workflows and includes batch tool integration for maximum efficiency.