attckdigital/smith/smith-update
Claude Code and agent skill by attckdigital/smith
- community
Checking that the SKILL.md file is still in the repository.
Update Smith to the latest upstream version. Compares the installed commit SHA against https://github.com/ATTCKDigital/smith main, prompts to update if behind, and refreshes global install (~/.claude/skills, ~/.claude/hooks, ~/.smith) plus per-project artifacts (.specify/scripts, .claude/commands/smith.*, CLAUDE.md / constitution.md via migrate-templates, optional manifest sidecar bootstrap). Workflow-gate compliant.
Install
npx vskill@latest install attckdigital/smith/smith-updateSKILL.md
Smith — Update to Latest
End-to-end skill for keeping Smith up to date. Detects local-vs-upstream commit drift, prompts to update, and runs the existing installer plus per-project refresh steps when invoked inside a Smith-initialized project.
Arguments: $ARGUMENTS (no positional args; reserved for future flags like --check / --no-project)
When to Use
- "is smith out of date?" / "update smith" / "let's update smith"
- After learning of a new Smith feature you want to adopt
- After an old project's
.smith/index/was generated against an earlier manifest schema and needs regeneration
Vault Logging
Throughout this action, log significant events to the vault session log. Read the session log path from .smith/vault/.current-session. If the file is missing or the vault is not initialized, skip all logging silently.
Timestamps are UTC. HH:MM:SS comes from date -u +%H:%M:%S — never a local clock, never a time from memory. The append already runs through a shell, so read the clock in that same command (TS=$(date -u +%H:%M:%S)) and spend no extra tool call. Substitute the resulting value: an unexpanded $(...) reaching the log is a known regression and will not parse. Every hook-written stamp in this log is date -u, so a local-clock entry lands hours away from its neighbours and skews the workflow window hooks/workflow_summary_lib.py derives from them.
Format:
Log at: invocation, after version detection (with SHAs + commits-behind), after global update, after per-project update, on completion.
Natural Language Triggers
If the user says any of these (or similar), treat as invoking this command:
- "update smith"
- "let's update smith"
- "is smith out of date"
- "smith is behind"
- "pull the latest smith"
Phase 0: Activate Workflow Tracking (Workflow-Gate Compliance)
/smith-update writes many files: install.sh's destructive cp -R of skills, the version file, settings.json merge, per-project script copies, etc. The PreToolUse workflow-gate hook (PR #20) would deny all of these without an active marker. So create the marker first.
Skip if no `.smith/` directory exists in the current working directory (the gate naturally exits silent in that case per PR #20, so no marker is needed). Otherwise create the marker via the shipped helper — the gate exempts create-active-workflow.sh by basename (per spec/31-workflow-gate-bootstrap) and deliberately blocks raw redirection into active-workflows/ to prevent forged markers, so a cat > marker.yaml heredoc here would be DENIED when no marker exists yet:
The marker is removed in Phase 6 cleanup (or on exit-with-no-changes paths). Use the shipped helper so it works under a Bash(rm:*) deny rule:
Phase 1: Detect Upstream and Installed Versions
Phase 2: Compute Commits-Behind
Per Q5-A: gh first, shallow-clone fallback.
Phase 3: Snapshot (Q7-A Rollback Safety)
Before any destructive work, snapshot the global install state. On non-zero exit from install.sh, restore.
Phase 3.5: Stop a Running Activity Daemon
scripts/install.sh refreshes ~/.smith/scripts/activity/ in place. A daemon started by /smith-activity has already imported the old server.py, state.py and friends into a long-lived Python process; rewriting the files underneath it leaves a process running code that no longer exists on disk, and any module it imports lazily afterwards comes from the new tree. That mix is worse than either version alone, and it survives until something happens to restart it.
So: stop it before Phase 4, and do not restart it afterwards. An update silently bringing a background listener back up is exactly the surprise OOS-4 rules out — the operator started that daemon deliberately and is the one who decides it comes back.
With the daemon down, hooks/activity-emitter.sh is an unconditional no-op — no port file means it exits 0 before any network call — so nothing else in the update needs to know about it.
Phase 4: Global Update
Clone smith-repo to a temp dir (or reuse the one from Phase 2's fallback), run installer, write version file.
Phase 5: Per-Project Update (Conditional)
Only runs if $PROJECT_DIR/.smith/ exists. Refresh Smith-owned files; never touch user files; offer manifest bootstrap if .smith/index/ is absent.
5.1 Refresh .specify/scripts/bash/ and .claude/commands/smith.*
Smith-owned files. Safe to overwrite. Detect orphans first (Q6-A + Q8-B unified pass).
This is the start of the file. Read the full SKILL.md on GitHub.
Security
- Security scanPassed, 100 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/smith-update/SKILL.md
Popularity
- Repository stars
- 41
- Repository forks
- 6
- 7-day trend score
- 19
Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/attckdigital/smith/smith-update)