Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/ai-sdlc-framework/ai-sdlc/cleanupgit clone --depth 1 https://github.com/ai-sdlc-framework/ai-sdlcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/ai-sdlc-framework/ai-sdlc/cleanup)<a href="https://agentmods.dev/commands/ai-sdlc-framework/ai-sdlc/cleanup"><img src="https://agentmods.dev/badge/commands/ai-sdlc-framework/ai-sdlc/cleanup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.00987 |
| Opus 5 | $0.00015 | $0.00494 |
| Sonnet 5 | $0.00006 | $0.00197 |
| Haiku 4.5 | $0.00003 | $0.00099 |
Grade A, and why
cleanup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Companion to /ai-sdlc execute. Two modes:
Mode 1 — Sweep all merged worktrees (no arguments)
When $ARGUMENTS is empty, do exactly what /ai-sdlc execute does at start: walk .worktrees/, check each branch's PR status via gh pr list, remove any whose PR has merged. Also remove the legacy project-level .worktrees/.active-task sentinel if present — it's no longer written by /ai-sdlc execute (per-worktree sentinels replaced it in AISDLC-81) and would only ever be a leftover from a much older run. Per-worktree .active-task files inside each worktree directory are removed automatically when git worktree remove deletes the worktree.
# Clear the legacy project-level sentinel if it still exists. Safe to delete:
# /ai-sdlc execute now writes per-worktree sentinels at .worktrees/<id>/.active-task
# instead of the project-level path.
rm -f .worktrees/.active-task
if [ ! -d .worktrees ]; then
echo "No .worktrees/ directory — nothing to sweep."
exit 0
fi
REMOVED=0
for wt in .worktrees/*/; do
[ -d "$wt" ] || continue
WT_BRANCH=$(git -C "$wt" rev-parse --abbrev-ref HEAD 2>/dev/null)
[ -z "$WT_BRANCH" ] && continue
[ "$WT_BRANCH" = "HEAD" ] && continue
MERGED_AT=$(gh pr list --head "$WT_BRANCH" --state merged --json mergedAt --jq '.[0].mergedAt' 2>/dev/null)
if [ -n "$MERGED_AT" ] && [ "$MERGED_AT" != "null" ]; then
echo "Removing $wt (branch $WT_BRANCH merged at $MERGED_AT)"
# The per-worktree .active-task sentinel (if any) is removed atomically
# with the worktree itself.
git worktree remove --force "$wt" 2>/dev/null || true
REMOVED=$((REMOVED + 1))
fi
done
echo "Swept $REMOVED merged worktree(s)."
Mode 2 — Force-remove a specific task's worktree
When $ARGUMENTS is a task ID (e.g. AISDLC-68), remove that worktree regardless of PR status. Useful for retries after a failed /ai-sdlc execute that left state behind.
TASK_ID_LOWER=$(echo "$ARGUMENTS" | tr '[:upper:]' '[:lower:]')
WORKTREE_PATH=".worktrees/$TASK_ID_LOWER"
if [ ! -d "$WORKTREE_PATH" ]; then
echo "No worktree at $WORKTREE_PATH — nothing to clean up."
exit 0
fi
# Capture the branch name before removing so we can remind the operator.
BRANCH=$(git -C "$WORKTREE_PATH" rev-parse --abbrev-ref HEAD 2>/dev/null)
# git worktree remove --force deletes the entire worktree directory, which
# includes the per-worktree .active-task sentinel written by /ai-sdlc execute
# Step 4. No separate `rm` needed — the sentinel goes with the worktree.
git worktree remove --force "$WORKTREE_PATH"
echo "Removed worktree $WORKTREE_PATH (was on branch $BRANCH)."
# Branch deletion is destructive and may erase work — leave it to the operator.
echo ""
echo "The branch '$BRANCH' is still present locally and possibly on origin."
echo "If you want to delete it: git branch -D '$BRANCH' && git push origin --delete '$BRANCH'"
echo "(NOT done automatically — branch deletion is operator-controlled per CLAUDE.md.)"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 77 lines · 30 tokens per session scan A f3495c501981
cleanup is a command published in the GitHub repository ai-sdlc-framework/ai-sdlc (92 stars, last pushed 10d ago), licensed Apache-2.0. It adds 30 tokens to every session and 987 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
spec-intake
Execute the canonical workflow: .agent/workflows/spec-intake.md.
research
Research a technical or product question.
at-dsgvo
You are helping an enterprise architect generate an Austrian Data Protection Assessment — the Austrian-specific GDPR layer applied by the Datenschutzbehörde (DSB) under the Datenschutzgesetz (DSG 2018, BGBl. I Nr. 165/1999 as amended). Run this after /arckit:eu-rgpd to add Austrian obligations that go beyond the EU…
au-soci-cirmp
You are an enterprise architect generating a Security of Critical Infrastructure Act 2018 (SOCI Act) / Critical Infrastructure Risk Management Program (CIRMP) governance and evidence pack for an Australian critical infrastructure asset or potentially regulated entity.
au-aescsf
You are an enterprise architect generating an Australian Energy Sector Cyber Security Framework (AESCSF) maturity assessment for an Australian energy-sector project, asset, market interface, OT environment, DER platform, or regulated energy business capability.
au-pspf
You are an enterprise architect generating a Protective Security Policy Framework (PSPF) compliance assessment for an Australian Government entity or contractor handling government information.