@longngn204/update-local-coding-agent
BSafely update an existing Local Coding Agent clone while preserving customer config, tunnel-client, and secrets.
Install
agr install @longngn204/update-local-coding-agent --target claudeWrites 1 file into .claude/skills/, pinned to git-ba51f320.
- .claude/skills/update-local-coding-agent/SKILL.md
Document
name: update-local-coding-agent description: Safely update an existing Local Coding Agent clone while preserving customer config, tunnel-client, and secrets.
Update Local Coding Agent
Use this when a customer wants their local clone updated to the latest GitHub version.
Rules
- Do not delete the customer workspace.
- Do not delete
tools/tunnel-client*. - Do not print, commit, or upload API keys, tunnel IDs, tokens, or local config.
- Do not run
git reset --hard,git clean, or destructive commands unless the customer explicitly approves. - If there are local changes, summarize them and ask before continuing.
Steps
- Find the local
local-coding-agentfolder. - Run
git status --short --branch. - If local changes exist, stop and ask before updating.
- Fetch:
git fetch origin main --tags
- Show incoming changes:
git log --oneline --decorate --max-count=10 HEAD..origin/main
- Update safely:
git pull --ff-only origin main
- Reinstall dependencies:
- Windows:
scripts\lca.cmd install - macOS/Linux:
bash scripts/lca install
- Windows:
- Validate:
node --check scripts/local-coding-agent.mjsnode --check scripts/network-doctor.mjsnode scripts/validate-skills.mjs
- Run doctor/status:
- Windows:
scripts\lca.cmd doctorandscripts\lca.cmd status - macOS/Linux:
bash scripts/lca doctorandbash scripts/lca status
- Windows:
- Restart only if the customer wants the agent running:
- stop, then start with the CLI wrapper for the OS.
Report Back
Return:
- current commit
- current version from
/healthzif running - MCP URL
- dashboard URL
- workspace path
- mode and policy
- tunnel status
- any failed check and exact next command
Trustgrade B
- passBody integrity
Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.
- passType matchnot applicable to this artifact type
Whether the artifact is really the kind of thing its metadata claims it is.
- passFreshness
How long since the source repository was last pushed to.
- passPrompt injection
Scans the artifact's own text for instructions aimed at your agent rather than at you.
- warnLicensecopyleft/unknown — index-and-link only
Whether the source repository declares an SPDX license permissive enough to redistribute.
How the grade is calculated
Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:
- Aevery check passed
- Bone warning
- Ctwo warnings
- Dprompt injection or body integrity failed, or three warnings
- Fone of those failed, and something else is wrong
These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.
Versions
git-ba51f320e41d2026-07-31