A command that updates the goal-flight controller and the worker command-line tools it sends work to.

Use it before unattended work or while investigating worker problems, and to see what changed in each update sweep.

It keeps both the orchestration rules and worker programs current, which can help avoid already-fixed failures during long runs.

update — Command by simonrowland

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/simonrowland/goal-flight/update

Clone the repo

git clone --depth 1 https://github.com/simonrowland/goal-flight

Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 3,058 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00000	$0.03058
Opus 5	$0.00000	$0.01529
Sonnet 5	$0.00000	$0.00612
Haiku 4.5	$0.00000	$0.00306

Measured yesterday against content hash 15398c810dcb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

update scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`nc -z -w 2 1.1.1.1 443`, or `curl -s -o /dev/null -w '%{http_code}' https://1.1.1.1`

commands/update.md · 262 lines

How it starts

The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/goal-flight update

Refresh goal-flight itself + the worker CLIs it dispatches to. Two sweeps in one command: pull latest goal-flight from origin, then run each CLI's built-in update mechanism. Reports a diff table for both. Sweep 2 swaps worker binaries; its idle gate below protects those binary swaps specifically. Sweep 1 plugin pulls stay unchanged.

Useful before starting a long unattended run (you want both fresh skill rules and fresh workers) or when triaging worker-side flakiness (might already be fixed upstream).

Installed skill resync

After source SKILL.md, commands/, protocols/, templates/, or adapters/ changes, copied host installs need ./install.sh <host> from the source repo unless the host skill path is a symlink; doctor JSON reports installed_skill_drift, and text mode prints installed_skill_md_hash WARNs.

Recipe

Sweep 1 — Update goal-flight plugin

Resolve the install path. The orchestrator already knows its own <skill-root> — pass that as GFROOT. If <skill-root> is a symlink (the common install pattern), resolve it to the underlying source repo so git operates on the canonical checkout:
```
GFROOT="$(realpath <skill-root>)"
```
realpath is BSD-native on macOS and GNU-native on Linux — same flag-less behavior on both. If $GFROOT isn't a git repo (e.g., the user installed via a tarball or a marketplace bundle that doesn't expose .git), emit STATUS: plugin install path is not a git checkout (path=$GFROOT) — skipping plugin update and skip to Sweep 2.

Capture current state:

GF_BEFORE_HEAD="$(git -C "$GFROOT" rev-parse --short HEAD)"
GF_BEFORE_VER="$(cat "$GFROOT/VERSION" 2>/dev/null || jq -r .version "$GFROOT/.claude-plugin/plugin.json" 2>/dev/null)"

Refuse to pull if working tree is dirty (don't risk losing the user's in-flight changes). git diff-index is blind to untracked files; use git status --porcelain which catches modified, staged, AND untracked entries:

Read the full file on GitHub · 262 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 262 lines · 0 tokens per session scan A 15398c810dcb

Subscribe to this mod's changes

update is a command published in the GitHub repository simonrowland/goal-flight (20 stars, last pushed 3d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,058 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Data and AI LLM Languages Research agentic ai claude codingagent devtools

update

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Makes network callslowCapability

How it starts

/goal-flight update

Installed skill resync

Recipe

Sweep 1 — Update goal-flight plugin

What this file has done since we first saw it

Other commands, from other repositories

review-context7-updates

init

mine

help

search

status