Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/azrtydxb/procoderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/azrtydxb/procoder/merge)<a href="https://agentmods.dev/commands/azrtydxb/procoder/merge"><img src="https://agentmods.dev/badge/commands/azrtydxb/procoder/merge/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/azrtydxb/procoder/merge"><img src="https://agentmods.dev/badge/commands/azrtydxb/procoder/merge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.01473 |
| Opus 5.5 | $0.00009 | $0.00589 |
| Sonnet 5.5 | $0.00005 | $0.00295 |
| Haiku 4.5 | $0.00002 | $0.00147 |
Grade A, and why
merge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
The user invoked /procoder:merge with arguments: $ARGUMENTS
(The argument is the PR number or branch; with none, use the PR for the
current branch: gh pr view --json number.)
First read .procoder/github/WORKFLOW.md and follow it — the repo's rules win over the defaults below. If it is missing, get the default via procoder templates, write it, then follow it.
A PR merges when EVERYTHING answers — never before.
- Don't block on the waiting: spawn a BACKGROUND agent whose only job is to
watch and report. The watcher never fixes, never replies, never merges —
it gathers information; you act on it. Continue other work while it
watches, and pick up the loop below each time it reports. Give the
watcher the merge-watching protocol from .procoder/github/WORKFLOW.md
verbatim: calibrate against previous runs of the same workflow, poll PER
JOB in the foreground (
gh run view <run-id> --json jobs— never a fire-and-forget monitor), report the FIRST failing job immediately with its--log-failedexcerpt instead of waiting for the rest, poll dynamically (fast early and near the calibrated finish, never slower than 90s), and report on every state change.
Loop until done:
-
Checks:
gh pr checks <pr>— every required check must pass. For a failing check, open its run (gh run view <id> --log-failed), fix the cause in the code, commit, push, and wait for the re-run. -
Reviews:
gh pr view <pr> --json reviews,reviewDecisionand the review comments viagh api repos/{owner}/{repo}/pulls/<pr>/comments. Treat BOT reviewers (Copilot included) exactly like humans: read every comment and recommendation, and for each one either- fix it (commit, push, then reply to the thread saying what changed), or
- reply with a concrete reason why not, or
- when it is real, non-blocking, and too large for this PR, TRACK IT
BEFORE MERGING:
procoder todo add <title>, or a backlog story where it belongs. Write the printed template to its named path, fill its criteria, and name the originating PR. Then reply with that id. "Out of scope for this PR" is only true if something now holds it; said on its own it is how a real finding is answered and then lost. No comment is skipped silently. Resolve threads only after fixing or answering (gh api graphqlresolveReviewThread), never to hide them.
Tracking never waives a failing check, a correctness or security blocker, or a required review change. Fix those before merging. Step 2b still applies now to every real finding, including tracked follow-up work; if the detecting layer cannot be adapted safely in this PR, stop.
How to receive review feedback — bot or human:
- VERIFY before implementing: check each claim against the actual code. Reviewers (Copilot especially) lack full context; a finding can be factually wrong for this codebase. Wrong → push back in the thread with the technical reason, not a fix.
- If ANY comment in a review is unclear, ask about it before implementing the others — comments are often related, and partial understanding produces the wrong fix.
- Fix one finding at a time and re-run the covering tests after each.
- Replies state facts: "Fixed in — ." No "great point", no thanks, no "you're absolutely right" — gratitude is not a verification, and performative agreement erodes the reviewer's trust in real agreements.
- A reviewer asking for an unused "proper" feature gets the YAGNI answer: show it is uncalled and propose removal instead.
2b. The reflection step — MANDATORY whenever step 2 found anything real (bot or human). An escaped finding is a bug in our gates; fixing only the finding leaves its class open:
- For each real finding, name the layer that should have caught it BEFORE the PR existed: a linter (lint baseline/config), the pre-PR rubric (.procoder/github/REVIEW.md), a quality controller, a pinning test, or CI itself.
- ADAPT that layer now, in this same PR: enable the linter rule, add the rubric line, tighten the controller, write the pinning test.
- Record each as an entry in .procoder/github/LESSONS.md (shape:
procoder templates), with the adaptation named. Then runprocoder lessons— it flags any entry left unlearned, and an unlearned lesson is not done. - False positives get no ledger entry — reflect only on real escapes.
- Then run
procoder copilot-leak. Copilot's auto-review sometimes opens ISSUES rather than PR comments, and those escape the reading in step 2 entirely: the finding gets fixed and nothing records that the class happened. The command finds them, strips every trace of the code from them, and asks before it files or records anything. This is the only place a procoder command talks to GitHub about reviews — the gate reads the resulting ledger offline and never queries.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago Changed · +12 lines f7e3942f8058
- 1mo ago First seen · 98 lines · 23 tokens per session scan A 4f592232df93
merge is a command published in the GitHub repository azrtydxb/procoder (211 stars, last pushed 4d ago), licensed Apache-2.0. It adds 23 tokens to every session and 1,473 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
pr-manager
Comprehensive pull request management with ruv-swarm coordination for automated reviews, testing, and merge workflows.
release
Release manager for frontend and mobile. Writes App Store notes, user-facing changelog, flags stale docs and landing copy. Actions: notes | changelog | docs | sync.
worktree
Manage git worktrees for isolated feature development.
sm-buff
You usually don't run buff directly — run sm sail. sm sail drives the whole PR to green and calls buff watch / triage for you, stopping only when it needs you to act (see /sm-sail). Reach for sm buff here only for surgical work: inspecting a specific failure, or resolving a single review thread when sail has parked on…
logic-health
Sweep a whole codebase or directory for logic correctness — use before a release or to identify risk hotspots.
review
Fast review of staged changes. Critical findings only — no style nits.