Borrowing it
Nothing to install: this file belongs to swarm-ai-research/swarm. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/swarm-ai-research/swarm/main/.claude/commands/release.mdgit clone --depth 1 https://github.com/swarm-ai-research/swarmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/swarm-ai-research/swarm/release)<a href="https://agentmods.dev/commands/swarm-ai-research/swarm/release"><img src="https://agentmods.dev/badge/commands/swarm-ai-research/swarm/release.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01524 |
| Opus 5 | $0.00000 | $0.00762 |
| Sonnet 5 | $0.00000 | $0.00305 |
| Haiku 4.5 | $0.00000 | $0.00152 |
Grade C, and why
release scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s https://pypi.org/pypi/swarm-safety/json | python -c "import sys,json;print('PyPI latest:', json.load(sys.stdin)['info']['version'])" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://pypi.org/pypi/swarm-safety/json | python -c "import sys,json;print('PyPI latest:', json.load(sys.stdin)['info']['version'])" How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/release
Cut a swarm-safety release end-to-end: bump versions, finalize the CHANGELOG via a Release PR, tag main, and shepherd the release.yml pipeline through to the PyPI publish and GitHub release — then verify it actually landed.
Pushing a v* tag triggers .github/workflows/release.yml: validate → test → build → publish (PyPI, OIDC trusted publishing) → github-release. This command's job is to make that pipeline succeed on the first tag and to recover cleanly if it doesn't.
Usage
/release [version] [--commit SHA]
Examples:
/release(minor-bump from the latest tag, confirm with user)/release 1.9.0/release --recover(a tag exists but its run failed before publishing — re-validate, fix, re-point the tag)
Critical invariants (these silently broke 1.6.0–1.8.0)
Before tagging, confirm all three or the publish will fail after a 10–60 min CI run:
release.ymltest extras — the test job must install.[dev,runtime,api,analysis,gamescape](matchesci.yml). A bare.[dev,runtime]missesmatplotlibetc. → 14 collection errors → build/publish silently skipped.- No direct-URL deps in
pyproject.toml— PyPI rejects PEP 508 direct refs (pkg @ git+https://…) with a 400 after build. Keep such deps out of declared extras (document a manual install instead). release.ymltest runs-n auto --dist=loadfile --timeout=300— serial + no timeout means ~60 min and a networked test can hang forever.
Steps
-
Pre-flight: be on
main, clean tree, synced (git fetch origin main;HEAD == origin/main). Determine the version: default = minor bump ofgit tag -l 'v*' --sort=-v:refname | head -1; confirm with the user. Must be valid semver. -
Bump versions — run
/bump_version <X.Y.Z>(updatespyproject.toml,CITATION.cff,skill.md). All three MUST match the tag, orvalidatefails. -
Finalize CHANGELOG — roll
## [Unreleased]→## [X.Y.Z] - <YYYY-MM-DD>, add a fresh empty## [Unreleased]. Read the diffs since the last tag and write human-quality entries under### Added/Changed/Fixed/Removed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 83 lines · 0 tokens per session scan C ef2978801f38
release is a command published in the GitHub repository swarm-ai-research/swarm (41 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,524 tokens. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
release
Before publishing, run the compatibility bootstrap.
land
Cadence-tick autonomous PR babysitter (CI-fix, resolve, converge, merge, close, release).
release-notes
Generate consistent, well-structured release notes from git history. Triggered on release tags following semver patterns (v..) to produce categorized changelog with breaking changes, features, fixes, and contributor attribution.
ship
Ship is the operational release-prep flow for a connected project repo.
release-plan
A release-planning command for a software change. It documents the release scope, rollback plan, gradual or full rollout, and monitoring before waiting for human approval.
release
Standalone SDK release command for the BUILD repo. Not a workspace phase — runs independently after any number of implement/redteam cycles. Handles PyPI publishing, documentation deployment, and CI management for the kailash Python SDK and its framework packages.