garden-desk: Command for Claude Code

.claude/commands/garden-desk-code-review.md

garden-desk-code-review is a command for Claude Code from alex-alecu/garden-desk. It costs 18 tokens per session (2,131 once invoked), scanned A, original, Apache-2.0.

A pull-request review command that assigns a single agent to small changes and a larger set of agents to larger changes.

In plain words
What is it for?
Use it to inspect a GitHub pull request and produce a review of its changes.
Why use it?
It structures review work according to the size of the change and follows repository-specific review instructions.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; mentions CLAUDE.md; mentions subagents.

This is alex-alecu/garden-desk's own configuration. It tells Claude Code how to work on garden-desk itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything garden-desk configures →

Reuse

Borrowing it

Nothing to install: this file belongs to alex-alecu/garden-desk. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/alex-alecu/garden-desk/main/.claude/commands/garden-desk-code-review.md
Clone the repo
git clone --depth 1 https://github.com/alex-alecu/garden-desk

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for garden-desk-code-review

README.md
[![agentmods](https://agentmods.dev/badge/commands/alex-alecu/garden-desk/garden-desk-code-review/github.svg)](https://agentmods.dev/commands/alex-alecu/garden-desk/garden-desk-code-review)
Your own site
<a href="https://agentmods.dev/commands/alex-alecu/garden-desk/garden-desk-code-review"><img src="https://agentmods.dev/badge/commands/alex-alecu/garden-desk/garden-desk-code-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for garden-desk-code-review

Your own site · 80×15
<a href="https://agentmods.dev/commands/alex-alecu/garden-desk/garden-desk-code-review"><img src="https://agentmods.dev/badge/commands/alex-alecu/garden-desk/garden-desk-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 18 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,131 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00018 $0.02131
Opus 5 $0.00009 $0.01066
Sonnet 5 $0.00004 $0.00426
Haiku 4.5 $0.00002 $0.00213

Measured 7d ago against content hash 68531154fb21, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

garden-desk-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/garden-desk-code-review.md · 59 lines

How it starts

The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Review the given pull request. REVIEW.md at the repository root is the primary review instruction set; CLAUDE.md and the files it imports are secondary general project context.

Agent assumptions (applies to all agents and subagents):

  • All tools are functional. Do not test tools or make exploratory calls.
  • Only call a tool when required to complete the task.
  • Read the pull request only with gh pr view, gh pr diff, and the gh api .../compare and gh api .../pulls read commands named below; read repository files only with Read, Grep, and Glob. Never run git.
  • Models and thinking levels are pinned: the orchestrator runs on the model and effort set by the workflow; subagents are the review-gate (Haiku, low effort), review-sonnet (Sonnet 5, high effort), and review-opus (Opus 5, medium effort) agents defined in .claude/agents/. Launch every agent with subagent_type set to one of those names and never override its model or effort. Those agents have no Agent tool, so they cannot launch agents of their own.

Waiting for agents (this runs unattended, so it must never stall or loop):

  • Agents run in the background. Tell every agent its time budget in its prompt ("You have N seconds; reply with what you have before then"). After launching a group of agents, call TaskOutput once per agent with block: true and the timeout given for that step. Do not poll, sleep, schedule wakeups, or use Monitor. Only a lens agent that is still running after its first wait gets one more TaskOutput with timeout 60000; no agent gets a third.
  • An agent whose final TaskOutput status is not completed, or whose output is empty or unusable, has failed: call TaskStop on it and apply the fallback given for that step.
  • Never end your turn while an agent you launched is still running; every step below ends with all its agents collected or stopped.

Review modes:

  • Full review: no earlier claude summary comment exists on the pull request. Review the whole gh pr diff.
  • Incremental review: the newest claude summary comment ends with a Reviewed <sha> line. Review only the commits after that sha, so work is not repeated. Per REVIEW.md, an incremental review posts CRITICAL and WARNING findings only.

Review tiers:

  • Small to medium: at most 400 changed lines and at most 15 changed files, after the exclusions in REVIEW.md. One review-opus agent reviews all four lenses and validates its findings.
  • Large: more than 400 changed lines or more than 15 changed files. Use the full agent set.
  • Measure the diff for this run and select the tier one time before a lens agent starts.

Follow these steps precisely:

  1. Launch a review-gate agent that returns: whether the pull request is closed or a draft; the current head sha from gh pr view <PR> --json headRefOid; and the sha from the Reviewed <sha> line of the newest claude comment in gh pr view <PR> --comments, or none. Wait with timeout 45000. Stop if the pull request is closed or a draft. Fallback: continue with a full review.

  2. Read REVIEW.md in full. Read CLAUDE.md and any file it references with @ syntax. Identify the review lenses that REVIEW.md defines under "WHAT TO REVIEW"; each inline [tag] line that introduces a bullet list is one lens.

  3. Choose the mode. With a reviewed sha, run gh api repos/<owner>/<repo>/compare/<reviewed-sha>...<head-sha> --jq '{status, files: [.files[] | {filename, additions, deletions, patch}]}'. If status is ahead and files is not empty, the mode is incremental and that output is the diff to review; also collect the earlier claude inline findings with gh api repos/<owner>/<repo>/pulls/<number>/comments --jq '.[] | select(.user.login == "claude[bot]") | {path, line, body}'. If status is identical, post nothing and stop. Otherwise (no reviewed sha, behind, diverged, or a failed command) the mode is full.

    Select the tier after the mode. In full mode, use gh pr view <PR> --json files --jq '[.files[] | select((.path | test("(^|/)(pnpm-lock.yaml|package-lock.json|yarn.lock)$|(^|/)__snapshots__/")) | not)] | {files: length, lines: (map(.additions + .deletions) | add // 0)}'. In incremental mode, calculate the same counts from the compare output files array and its filename, additions, and deletions values, with the same path exclusions. Log the counts and the selected tier.

Read the full file on GitHub · 59 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 59 lines · 18 tokens per session scan A 68531154fb21

Subscribe to this mod's changes

garden-desk-code-review is a command published in the GitHub repository alex-alecu/garden-desk (6 stars, last pushed 2d ago), licensed Apache-2.0. It adds 18 tokens to every session and 2,131 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.