Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/modelstudioai/cli/branch-merge-reviewgit clone --depth 1 https://github.com/modelstudioai/cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01807 |
| Opus 5 | $0.00000 | $0.00903 |
| Sonnet 5 | $0.00000 | $0.00361 |
| Haiku 4.5 | $0.00000 | $0.00181 |
Grade A, and why
branch-merge-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
分支合并 Review
触发条件
- 评估某分支(feature / pipeline / 重构分支)能否合到
main - 评估合并后对原有功能的侵入性影响
- 用户问"X 分支可以合 Y 吗 / 有什么影响"
目标
- 不破坏原功能:共享文件的运行时行为、公共类型、构建配置不能静默变化
- 新功能可发现:用户可见的新命令/新 flag 必须有文档和示例
步骤(按顺序)
① 看分歧
git fetch origin <base>
git log --oneline <base>..<head> # head 比 base 多的提交
git log --oneline <head>..<base> # base 比 head 多的提交(双向都看,base 已大幅领先时尤其重要)
② 干跑合并,先确认有无冲突
git merge-tree $(git merge-base <base> <head>) <base> <head> > /tmp/merge.txt
echo "exit=$?"
grep -E "^(<<<<<<<|>>>>>>>|CONFLICT)" /tmp/merge.txt | head -20
- exit=0 且无
<<<<<<<→ 机器可合,继续 ③ - 有冲突 → 先列冲突文件,把方案讲清楚再动手
③ 拆 diff:共享文件 vs 新增文件
git diff --stat <base>...<head>
git diff --name-only <base>...<head>
- 新增文件(对方分支没有)→ 侵入性 = 0,只看是否需要文档透出(跳到清单 B)
- 共享文件(两边都有)→ 重点看,逐个跑
git diff <base>...<head> -- <file>,过清单 A
清单 A:侵入性(共享文件必看)
- 运行时行为没静默变化:默认值、错误码 /
ExitCode、retry 次数、并发度、超时 - 公共类型 / 导出签名向后兼容:新增可选字段 OK;改必填、删字段、改返回类型 → 不行(参考 packages/core/src/types/)
-
pnpm-workspace.yaml没收窄通配:packages/*改成显式列表会漏掉目标分支新增的子包(本次 pipeline → main 踩过这个坑,漏了packages/skills) -
package.json没破坏发布元数据:bin/exports/files/inlinedDependencies字段任何删除或改名都要单独评估 - 公共依赖没被悄悄升级:catalog / 根 lockfile 改动要列出来
-
package.jsonversion 没倒退:目标分支已经更高时(如 main 1.0.3 vs head 1.0.0-beta.1),手动对齐版本号,不要被 head 覆盖 - 全局表没冲突:
packages/cli/src/commands.ts/packages/kscli/src/main.tscommand map、defineCommand({ auth })、GLOBAL_FLAGS/MODEL_AUTH_FLAGS/CONSOLE_AUTH_FLAGS/OPENAPI_AUTH_FLAGS、ExitCode新增项不和现有项冲突
清单 B:用户透出(用户可见的新东西必看)
- 新命令 / 新 flag 已同步到用户面文档:
- README.md + README.zh.md(中英文都要,常漏
_CN) - 各
skills/<skill>/reference/+ 对应SKILL.md通过pnpm run sync:skill-assets更新并提交
- README.md + README.zh.md(中英文都要,常漏
-
bl <cmd> --help文案完整:description/examples都填了 - demo / quickstart:用户可调用的新命令至少有一个示例
- 行为变化的老命令:在 commit message / CHANGELOG 注明用户感知的差异
- 错误信息 / 提示文案:面向用户的字符串通顺、双语(项目主体是中文场景)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 105 lines · 0 tokens per session scan A 60538e8a512a
branch-merge-review is an agent published in the GitHub repository modelstudioai/cli (320 stars, last pushed 4d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,807 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
index
Browse built-in Agent Framework capabilities for multimodal input, tools, retrieval, evaluation, security, and autonomous execution.
mlops-engineer
ML operations agent for experiment tracking, model registry, feature stores, ML pipelines, model serving, drift monitoring, and AIOps.
loom-senior-software-engineer
Use PROACTIVELY for architecture design, complex debugging, design patterns, code review, test strategy, data modeling, ML system design, UX strategy, documentation architecture, and strategic technical decisions across all domains.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
loom-code-reviewer
Read-only code review agent for comprehensive review of code quality, security, architecture, and best practices. Cannot modify files.
integrity-check
Detect adversarial content in .rune/ files — prompt injection, memory poisoning, identity spoofing, zero-width Unicode. Verdict: CLEAN/SUSPICIOUS/TAINTED.