forge-update

forge-update is a command for Claude Code from sangrokjung/claude-forge. It costs 15 tokens per session (2,404 once invoked), scanned D, original, MIT.

A command for updating the Claude Forge framework from its remote Git repository. It can check for updates, pull them, and run post-update steps.

In plain words
What is it for?
Use /forge-update to check for updates, update normally, or use --check-only and --force when the command’s options fit the situation.
Why use it?
It provides a repeatable update process and checks that the local repository is the expected Claude Forge installation.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions CLAUDE.md.

Part of the claude-forge plugin — 33 skills, 39 commands, 17 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/sangrokjung/claude-forge/forge-update
Clone the repo
git clone --depth 1 https://github.com/sangrokjung/claude-forge

Made for: Claude Code.

Or install claude-forge, the plugin that ships this one along with the rest of its 33 skills, 39 commands, 17 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for forge-update

README.md
[![agentmods](https://agentmods.dev/badge/commands/sangrokjung/claude-forge/forge-update.svg)](https://agentmods.dev/commands/sangrokjung/claude-forge/forge-update)
Your own site
<a href="https://agentmods.dev/commands/sangrokjung/claude-forge/forge-update"><img src="https://agentmods.dev/badge/commands/sangrokjung/claude-forge/forge-update.svg" alt="Measured on agentmods" height="20"></a>
Per session 15 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,404 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00015 $0.02404
Opus 5 $0.00008 $0.01202
Sonnet 5 $0.00003 $0.00481
Haiku 4.5 $0.00002 $0.00240

Measured 6d ago against content hash d6f3a19aa051, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade D, and why

forge-update scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

chmod 600 "$FORGE_META"

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

cp "$REPO_PATH/settings.json" "$HOME/.claude/settings.json"

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf "$HOME/.claude/${dir}.old"
commands/forge-update.md · 332 lines

How it starts

The opening of the file, as written. The whole thing — 332 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/forge-update - Claude Forge 자체 업데이트


플래그

플래그 설명
--check-only 업데이트 확인만, 실제 pull하지 않음
--force 로컬 변경사항이 있어도 stash 후 강제 진행
(없음) 업데이트 확인 + pull + 후처리

1단계: 메타파일 로드

FORGE_META="$HOME/.claude/.forge-meta.json"

메타파일이 있으면:

REPO_PATH=$(jq -r '.repo_path' "$FORGE_META")
INSTALL_MODE=$(jq -r '.install_mode' "$FORGE_META")
CURRENT_VERSION=$(jq -r '.version' "$FORGE_META")
CURRENT_COMMIT=$(jq -r '.git_commit' "$FORGE_META")

메타파일이 없으면 (이전 버전 설치):

# symlink에서 저장소 경로 추론
REPO_PATH=$(cd -P "$(readlink "$HOME/.claude/agents")" 2>/dev/null && cd .. && pwd)

추론도 실패하면 에러:

Claude Forge 저장소를 찾을 수 없습니다.
다시 clone 후 install.sh를 실행하세요:
  git clone https://github.com/sangrokjung/claude-forge.git
  cd claude-forge && ./install.sh

2단계: 저장소 검증 (CRITICAL - 보안)

repo_path를 신뢰하기 전에 반드시 검증한다.

# 1. 경로 정규화 (심링크 해제)
REPO_PATH=$(cd "$REPO_PATH" 2>/dev/null && pwd -P)

# 2. .git 디렉토리 존재 확인
ls -d "$REPO_PATH/.git"

# 3. claude-forge 저장소인지 특징 파일로 검증
ls "$REPO_PATH/.claude-plugin/plugin.json"

# 4. remote URL이 claude-forge인지 확인
REMOTE_URL=$(cd "$REPO_PATH" && git remote get-url origin 2>/dev/null)
echo "$REMOTE_URL" | grep -q 'claude-forge'

검증 실패 시:

저장소 경로가 유효하지 않거나 claude-forge 저장소가 아닙니다: {REPO_PATH}
다시 clone 후 install.sh를 실행하세요.

3단계: 로컬 변경사항 체크

cd "$REPO_PATH"
git status --porcelain

변경사항이 있으면:

  • --force 없음: 경고 메시지 출력 + 중단
    로컬 변경사항이 있습니다:
      {변경 파일 목록}
    --force 플래그로 stash 후 진행하거나, 수동으로 정리해주세요.
    
  • --force 있음: git stash 실행 후 진행

4단계: 원격 fetch + 기본 브랜치 감지

git fetch origin

실패 시 (네트워크 오류):

원격 저장소에 연결할 수 없습니다.
네트워크 연결을 확인하세요.

기본 브랜치 동적 감지:

DEFAULT_BRANCH=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||')
if [ -z "$DEFAULT_BRANCH" ]; then
    DEFAULT_BRANCH="main"
fi

5단계: 버전 비교

LOCAL_HEAD=$(git rev-parse HEAD)
REMOTE_HEAD=$(git rev-parse "origin/$DEFAULT_BRANCH")

Read the full file on GitHub · 332 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 332 lines · 15 tokens per session scan D d6f3a19aa051

Subscribe to this mod's changes

forge-update is a command published in the GitHub repository sangrokjung/claude-forge (824 stars, last pushed 2d ago), licensed MIT. It adds 15 tokens to every session and 2,404 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.