agy-update

A command that checks whether a newer version of the agy plugin is available from its Git repository. It updates the plugin only after confirmation and only when the checkout is clean.

In plain words
What is it for?
Use it to compare the installed plugin with the latest version, identify required local cleanup, and pull an approved update.
Why use it?
It avoids pulling updates over uncommitted work and makes version checks explicit.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/vit129/agy-plugin-cc/agy-update
Clone the repo
git clone --depth 1 https://github.com/Vit129/agy-plugin-cc
Per session 16 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 491 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00016 $0.00491
Opus 5 $0.00008 $0.00246
Sonnet 5 $0.00003 $0.00098
Haiku 4.5 $0.00002 $0.00049

Measured 2d ago against content hash 1e2ad6706bcb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

agy-update scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL --max-time 3 https://raw.githubusercontent.com/Vit129/agy-plugin-cc/main/version.json
commands/agy-update.md · 41 lines

What it actually says

This plugin is installed via git clone, not npm. Check version.json on the main branch of Vit129/agy-plugin-cc on GitHub against the CURRENT_VERSION constant in plugins/agy/scripts/lib/git-update-check.mjs, and pull only with explicit confirmation.

Steps:

  1. Find the git checkout root and confirm it is clean:
cd "${CLAUDE_PLUGIN_ROOT}/../.." 2>/dev/null || true
git rev-parse --show-toplevel
git status --short --untracked-files=normal

If the working tree is not clean (the status command prints anything), stop and tell the user there are uncommitted changes — they must commit/stash and re-run this command themselves. Do not offer to pull.

  1. Fetch the remote version file:
curl -fsSL --max-time 3 https://raw.githubusercontent.com/Vit129/agy-plugin-cc/main/version.json

If this fails (offline/blocked/timeout), tell the user the version check failed and why, and stop.

  1. Read CURRENT_VERSION from plugins/agy/scripts/lib/git-update-check.mjs and compare to the fetched version field.
  • If the remote version is not greater than CURRENT_VERSION, tell the user they're already up to date and stop.
  • If the remote version is greater, use AskUserQuestion to ask the user whether to pull now, showing the remote summary and updated date. Options: "Pull now" and "Not now".
  1. If the user chooses "Pull now", run git pull origin main in the checkout root and report the result verbatim (success, or the conflict/error output so the user can resolve it themselves).

  2. If the user chooses "Not now" (or the question is answered in a non-interactive context with no reply), do not pull. Instead remember the dismissal so the session-start hook stops repeating this notice until a newer version ships:

mkdir -p "$HOME/.config/agy-plugin-cc"
printf '%s\n' "<remote version number>" > "$HOME/.config/agy-plugin-cc/update-dismissed"
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 41 lines · 16 tokens per session scan A 1e2ad6706bcb

Subscribe to this mod's changes

agy-update is a command published in the GitHub repository Vit129/agy-plugin-cc (5 stars, last pushed 9d ago), licensed MIT. It adds 16 tokens to every session and 491 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.