Borrowing it
Nothing to install: this file belongs to terrene-foundation/metis. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/terrene-foundation/metis/main/.claude/commands/sync.mdgit clone --depth 1 https://github.com/terrene-foundation/metisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/terrene-foundation/metis/sync)<a href="https://agentmods.dev/commands/terrene-foundation/metis/sync"><img src="https://agentmods.dev/badge/commands/terrene-foundation/metis/sync/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/terrene-foundation/metis/sync"><img src="https://agentmods.dev/badge/commands/terrene-foundation/metis/sync.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.03978 |
| Opus 5.5 | $0.00008 | $0.01591 |
| Sonnet 5.5 | $0.00004 | $0.00796 |
| Haiku 4.5 | $0.00002 | $0.00398 |
Grade D, and why
sync scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
2. **Read obsoleted list from the resolved template**: `cat "$RESOLVED_TEMPLATE_PATH/.claude/.coc-obsoleted"` (slim purpose-built file; emitted by coc-sync Step 4.5). Each non-comment, non-blank line is a repo-relative p Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "./$path" How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sync CO/COC artifacts. Behavior depends on repo type (from .claude/VERSION).
Usage: /sync [target]
- At loom/ (coc-source):
target=py,rs, orall. If omitted, ask. - At downstream projects (coc-project): no target needed.
Step 0: Detect Repo Type
Read .claude/VERSION → type field:
coc-source→ Gate 1 + Gate 2 (below)coc-project→ Downstream Sync (next section)coc-use-template/coc-build→ MUST verify the repo is the actual template/BUILD repo before routing to loom. Checkbasename $(pwd)+git remote get-url origin(normalize SSHgit@host:owner/repo.git→owner/repo) against known repos:kailash-coc-claude-{py,rs,rb,prism},kailash-{py,rs,prism}. If match → "receives artifacts from loom/, run/syncat loom/". If no match → treat ascoc-projectand auto-correct VERSION in-place (type →coc-project, upstream →{template, template_repo, template_version, synced_at, sdk_packages}per.claude/hooks/lib/version-utils.js::correctTemplateDerivedVersion), then Downstream Sync.- Missing → ask user what type this repo is
Downstream Sync (coc-project repos)
Pull latest artifacts from the USE template repo. No target needed — reads template identity from VERSION.
Process:
- Resolve template (canonical resolver, v2.9.1+):
node "$RESOLVED_TEMPLATE_PATH/.claude/bin/resolve-template.js"if a previous sync already exists locally, OR for first-time sync:node "$(npm root -g 2>/dev/null)/.../bin/resolve-template.js"is unavailable — instead, replicate the resolver inline. Resolution order:- Step 1 —
KAILASH_COC_TEMPLATE_PATHenv var. If set and contains.claude/, use it. Source:env-override. - Step 2 — Cache at
~/.cache/kailash-coc/<template>/. Auto-update viagit -C <cache> fetch --depth 1 origin main && git -C <cache> reset --hard origin/main. Source:cache. - Step 3 — If no cache:
git clone --depth 1 --single-branch --branch main https://github.com/<template_repo>.git ~/.cache/kailash-coc/<template>/. Source:cloned. - Step 4 (offline fallback only) — Local sibling at
../<template>/or~/repos/loom/<template>/. Used ONLY when steps 2-3 all fail (network unreachable). Source:sibling-offline-fallback. Emit afreshness NOT guaranteednotice. - If a local sibling is detected during online resolution but NOT used, emit one stderr notice telling the user to set
KAILASH_COC_TEMPLATE_PATHif they meant to use it. - Known slugs:
kailash-coc-claude-{py,rs,rb,prism}and the new multi-CLIkailash-coc-{py,rs}all live underterrene-foundation/. - NEVER use the legacy
scripts/resolve-template.jsshim — it was added to the manifest'sobsoleted:list in v2.9.1 and is purged in step 3 below.
- Step 1 —
- Read obsoleted list from the resolved template:
cat "$RESOLVED_TEMPLATE_PATH/.claude/.coc-obsoleted"(slim purpose-built file; emitted by coc-sync Step 4.5). Each non-comment, non-blank line is a repo-relative path; trailing slash means directory. If the file is missing, the template predates v2.9.1 — log a one-line warning, skip step 3, and proceed; the obsoleted purge will happen on the NEXT sync once the template upgrades. - Purge obsoleted paths in this consumer (MUST, before any merge):
For each entry in the obsoleted list:
This is the ONLY mechanism by which downstream consumers purge stale orphan directories from former COC layouts. Skipping it leavesfor path in <obsoleted-paths>; do if [ -e "./$path" ]; then rm -rf "./$path" echo "obsoleted: removed ./$path" fi donerequire("./lib/...")resolving against the wrong sibling and ships hooks that fail at every CC session start withMODULE_NOT_FOUND. - Diff template's
.claude/against local — MUST diff EVERY child directory under.claude/, NOT only the COC-tier directories. Specifically the diff MUST include:.claude/agents/**,.claude/commands/**,.claude/rules/**,.claude/skills/**,.claude/guides/**(the codegen-content tiers).claude/hooks/**— runtime enforcement scripts (canonical location since v2.9.1; required for SessionStart, PreToolUse, etc. to fire).claude/hooks/lib/**— sibling helper modules (workspace-utils.js, etc.) loaded viarequire("./lib/...")fromhooks/*.js.claude/bin/**— resolver + emitter binaries (resolve-template.js,emit.mjs); without these the resolver cannot run.claude/.coc-obsoleted— the obsoleted-purge contract file itself (read in step 2; updates land here)- Top-level
scripts/migrate.pyand other items declared in the manifest'svariant_only:block — these live OUTSIDE.claude/but are part of the syncable set - NOT
scripts/hooks/or.claude/scripts/— those are obsoleted (purged in step 3) and MUST NOT be re-emitted. BLOCKED rationalizations: "hooks/ are not codegen artifacts so the diff skips them" / "the manifest tiers section doesn't list hooks/**, so hooks aren't in the syncable set" / "the consumer's settings.json hooks paths are normalized in step 7, so the scripts arriving on disk is a separate concern". The.claude/hooks/directory MUST physically exist on the consumer's disk for the normalized settings.json paths to resolve at runtime — hook-path normalization without hook-script delivery is a no-op that ships a broken session.
- Additive merge (same semantics as Gate 2 step 4):
- Template files overwrite matching local files
- Local-only files preserved (never deleted) except paths matching the manifest's
obsoleted:list (handled in step 3 above) - NEVER overwritten (downstream-owned):
CLAUDE.md,.claude/VERSION,.claude/settings.local.json,.env,.git/,.claude/.proposals/,.claude/learning/ - Other exclusions: see sync-flow guide § "What downstream NEVER gets"
- Present merge plan with per-file decisions before applying — include the obsoleted-path deletions from step 3 in the plan output so the user sees exactly what's being removed.
- Normalize settings.json hook paths: scan the consumer's
.claude/settings.jsonfor anyhooks[].commandentry containing$CLAUDE_PROJECT_DIR/scripts/hooks/and rewrite to$CLAUDE_PROJECT_DIR/.claude/hooks/. Stale references would still fail withMODULE_NOT_FOUNDafter step 3 deleted the directory. - Verify hook paths in
settings.jsonresolve on disk under.claude/hooks/ANDgrep -F 'scripts/hooks' .claude/settings.jsonreturns zero matches. - Update
.claude/VERSIONin-place (never replace the file — only update specific fields):upstream.template_version← template VERSION'sversion,upstream.template_repo← resolved GitHub slug,upstream.synced_at← now,upstream.sdk_packages← from template. MUST preservetype: coc-project,upstream.template(name), and all other fields. - Update SDK pins in
pyproject.toml/Cargo.tomlfrom template VERSION'supstream.sdk_packages - Install:
uv sync(py) orcargo check(rs) — MANDATORY - Update
.claude/.coc-sync-markerwith timestamp + list of obsoleted paths purged in step 3 (audit trail for the migration)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 180 lines · 21 tokens per session scan D c355a7123d39
sync is a command published in the GitHub repository terrene-foundation/metis (2 stars, last pushed 5mo ago), licensed Apache-2.0. It adds 21 tokens to every session and 3,978 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 2 findings (reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
merge-conflict-analysis
You are analyzing merge conflicts for PR #${{ pr-number }}.
release-notes
Generate consistent, well-structured release notes from git history. Triggered on release tags following semver patterns (v..) to produce categorized changelog with breaking changes, features, fixes, and contributor attribution.
commit
A command that examines staged Git changes and proposes a commit message using the Conventional Commits format, such as feat, fix, or docs. Git is a tool for tracking changes to code.
repo-audit
Audit a codebase (local or remote GitHub/GitLab) against architecture principles and requirements, surfacing drift, risk, and missing decisions.
pr
Handle the full workflow from current branch state to an open, CI-monitored pull request.
release-plan
A release-planning command for a software change. It documents the release scope, rollback plan, gradual or full rollout, and monitoring before waiting for human approval.