Setup CaliberSAFE

Continuously sync your AI setups with one command. Codebase tailor suited agent skills, MCPs and config files for Claude Code, Cursor, and Codex.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: setup-caliber
description: Sets up Caliber for automatic AI agent context sync. Installs pre-commit hooks so CLAUDE.md, Cursor rules, and Copilot instructions update automatically on every commit. Use when Caliber hooks are not yet installed or when the user asks about keeping agent configs in sync.
---

# Setup Caliber

Dynamic onboarding for Caliber — automatic AI agent context sync.
Run all diagnostic steps below on every invocation to determine what's already
set up and what still needs to be done.

## Instructions

Run these checks in order. For each step, check the current state first,
then only act if something is missing.

### Step 1: Check if Caliber is installed

```bash
command -v caliber >/dev/null 2>&1 && caliber --version || echo "NOT_INSTALLED"
```

- If a version prints → Caliber is installed globally. Set `CALIBER="caliber"` and move to Step 2.
- If NOT_INSTALLED → Install it globally (faster for daily use since the pre-commit hook runs on every commit):
  ```bash
  npm install -g @rely-ai/caliber
  ```
  Set `CALIBER="caliber"`.

  If npm fails (permissions, no sudo, etc.), fall back to npx:
  ```bash
  npx @rely-ai/caliber --version 2>/dev/null || echo "NO_NODE"
  ```
  - If npx works → Set `CALIBER="npx @rely-ai/caliber"`. This works but adds ~500ms per invocation.
  - If NO_NODE → Tell the user: "Caliber requires Node.js >= 20. Install Node first, then run /setup-caliber again." Stop here.

### Step 2: Check if pre-commit hook is installed

```bash
grep -q "caliber" .git/hooks/pre-commit 2>/dev/null && echo "HOOK_ACTIVE" || echo "NO_HOOK"
```

- If HOOK_ACTIVE → Tell the user: "Pre-commit hook is active — configs sync on every commit." Move to Step 3.
- If NO_HOOK → Tell the user: "I'll install the pre-commit hook so your agent configs sync automatically on every commit."
  ```bash
  $CALIBER hooks --install
  ```

### Step 3: Detect agents and check if configs exist

First, detect which coding agents are configured in this project:
```bash
AGENTS=""
[ -d .claude ] && AGENTS="claude"
[ -d .cursor ] && AGENTS="${AGENTS:+$AGENTS,}cursor"
[ -d .agents ] || [ -f AGENTS.md ] && AGENTS="${AGENTS:+$AGENTS,}codex"
[ -f .github/copilot-instructions.md ] && AGENTS="${AGENTS:+$AGENTS,}github-copilot"
echo "DETECTED_AGENTS=${AGENTS:-none}"
```

If no agents are detected, ask the user which coding agents they use (Claude Code, Cursor, Codex, GitHub Copilot).
Build the agent list from their answer as a comma-separated string (e.g. "claude,cursor").

Then check if agent configs exist:
```bash
echo "CLAUDE_MD=$([ -f CLAUDE.md ] && echo exists || echo missing)"
echo "CURSOR_RULES=$([ -d .cursor/rules ] && ls .cursor/rules/*.mdc 2>/dev/null | wc -l | tr -d ' ' || echo 0)"
echo "AGENTS_MD=$([ -f AGENTS.md ] && echo exists || echo missing)"
echo "COPILOT=$([ -f .github/copilot-instructions.md ] && echo exists || echo missing)"
```

- If configs exist for the detected agents → Tell the user which configs are present. Move to Step 4.
- If configs are missing → Tell the user: "No agent configs found. I'll generate them now."
  Use the detected or user-selected agent list:
  ```bash
  $CALIBER init --auto-approve --agent <comma-separated-agents>
  ```
  For example: `$CALIBER init --auto-approve --agent claude,cursor`
  This generates CLAUDE.md, Cursor rules, AGENTS.md, skills, and sync infrastructure for the specified agents.

### Step 4: Check if configs are fresh

```bash
$CALIBER score --json --quiet 2>/dev/null | head -1
```

- If score is 80+ → Tell the user: "Your configs are in good shape (score: X/100)."
- If score is below 80 → Tell the user: "Your configs could be improved (score: X/100). Want me to run a refresh?"
  If yes:
  ```bash
  $CALIBER refresh
  ```

### Step 5: Ask about team setup

Ask the user: "Are you setting up for yourself only, or for your team too?"

- If **solo** → Continue with solo setup:

  Check if session learning is enabled:
  ```bash
  $CALIBER learn status 2>/dev/null | head -3
  ```
  - If learning is already enabled → note it in the summary.
  - If not enabled → ask the user: "Caliber can learn from your coding sessions — when you correct a mistake or fix a pattern, it remembers for next time. Enable session learning?"
    If yes:
    ```bash
    $CALIBER learn install
    ```

  Then tell the user:
  "You're all set! Here's what happens next:
  - Every time you commit, Caliber syncs your agent configs automatically
  - Your CLAUDE.md, Cursor rules, and AGENTS.md stay current with your code
  - Run `$CALIBER skills` anytime to discover community skills for your stack"

  Then show the summary (see below) and stop.

- If **team** → Check if the GitHub Action already exists:
  ```bash
  [ -f .github/workflows/caliber-sync.yml ] && echo "ACTION_EXISTS" || echo "NO_ACTION"
  ```
  - If ACTION_EXISTS → Tell the user: "GitHub Action is already configured."
  - If NO_ACTION → Tell the user: "I'll create a GitHub Action that syncs configs nightly and on every PR."
    Write this file to `.github/workflows/caliber-sync.yml`:
    ```yaml
    name: Caliber Sync
    on:
      schedule:
        - cron: '0 3 * * 1-5'
      pull_request:
        types: [opened, synchronize]
      workflow_dispatch:
    jobs:
      sync:
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v4
          - uses: caliber-ai-org/ai-setup@v1
            with:
              mode: sync
              auto-refresh: true
              comment: true
              github-token: ${{ secrets.GITHUB_TOKEN }}
            env:
              ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    ```
    Now determine which LLM provider the team uses. Check the local Caliber config:
    ```bash
    $CALIBER config --show 2>/dev/null || echo "NO_CONFIG"
    ```

    Based on the provider, the GitHub Action needs the corresponding secret:
    - **anthropic** → `ANTHROPIC_API_KEY`
    - **openai** → `OPENAI_API_KEY`
    - **vertex** → `VERTEX_PROJECT_ID` and `GOOGLE

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.