Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/azrtydxb/procoder/mergegit clone --depth 1 https://github.com/azrtydxb/procoderWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.01299 |
| Opus 5 | $0.00012 | $0.00649 |
| Sonnet 5 | $0.00005 | $0.00260 |
| Haiku 4.5 | $0.00002 | $0.00130 |
Grade A, and why
merge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
The user invoked /procoder:merge with arguments: $ARGUMENTS
(The argument is the PR number or branch; with none, use the PR for the
current branch: gh pr view --json number.)
First read .procoder/github/WORKFLOW.md and follow it — the repo's rules win over the defaults below. If it is missing, get the default via procoder templates, write it, then follow it.
A PR merges when EVERYTHING answers — never before.
- Don't block on the waiting: spawn a BACKGROUND agent whose only job is to
watch and report. The watcher never fixes, never replies, never merges —
it gathers information; you act on it. Continue other work while it
watches, and pick up the loop below each time it reports. Give the
watcher the merge-watching protocol from .procoder/github/WORKFLOW.md
verbatim: calibrate against previous runs of the same workflow, poll PER
JOB in the foreground (
gh run view <run-id> --json jobs— never a fire-and-forget monitor), report the FIRST failing job immediately with its--log-failedexcerpt instead of waiting for the rest, poll dynamically (fast early and near the calibrated finish, never slower than 90s), and report on every state change.
Loop until done:
-
Checks:
gh pr checks <pr>— every required check must pass. For a failing check, open its run (gh run view <id> --log-failed), fix the cause in the code, commit, push, and wait for the re-run. -
Reviews:
gh pr view <pr> --json reviews,reviewDecisionand the review comments viagh api repos/{owner}/{repo}/pulls/<pr>/comments. Treat BOT reviewers (Copilot included) exactly like humans: read every comment and recommendation, and for each one either- fix it (commit, push, then reply to the thread saying what changed), or
- reply with a concrete reason why not.
No comment is skipped silently. Resolve threads only after fixing or
answering (
gh api graphqlresolveReviewThread), never to hide them.
How to receive review feedback — bot or human:
- VERIFY before implementing: check each claim against the actual code. Reviewers (Copilot especially) lack full context; a finding can be factually wrong for this codebase. Wrong → push back in the thread with the technical reason, not a fix.
- If ANY comment in a review is unclear, ask about it before implementing the others — comments are often related, and partial understanding produces the wrong fix.
- Fix one finding at a time and re-run the covering tests after each.
- Replies state facts: "Fixed in — ." No "great point", no thanks, no "you're absolutely right" — gratitude is not a verification, and performative agreement erodes the reviewer's trust in real agreements.
- A reviewer asking for an unused "proper" feature gets the YAGNI answer: show it is uncalled and propose removal instead.
2b. The reflection step — MANDATORY whenever step 2 found anything real (bot or human). An escaped finding is a bug in our gates; fixing only the finding leaves its class open:
- For each real finding, name the layer that should have caught it BEFORE the PR existed: a linter (lint baseline/config), the pre-PR rubric (.procoder/github/REVIEW.md), a quality controller, a pinning test, or CI itself.
- ADAPT that layer now, in this same PR: enable the linter rule, add the rubric line, tighten the controller, write the pinning test.
- Record each as an entry in .procoder/github/LESSONS.md (shape:
procoder templates), with the adaptation named. Then runprocoder lessons— it flags any entry left unlearned, and an unlearned lesson is not done. - False positives get no ledger entry — reflect only on real escapes.
- Then run
procoder copilot-leak. Copilot's auto-review sometimes opens ISSUES rather than PR comments, and those escape the reading in step 2 entirely: the finding gets fixed and nothing records that the class happened. The command finds them, strips every trace of the code from them, and asks before it files or records anything. This is the only place a procoder command talks to GitHub about reviews — the gate reads the resulting ledger offline and never queries.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 98 lines · 23 tokens per session scan A 4f592232df93
merge is a command published in the GitHub repository azrtydxb/procoder (196 stars, last pushed 2d ago), licensed Apache-2.0. It adds 23 tokens to every session and 1,299 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
setup
Initialize a new project with SDLC-compliant structure. Creates required files, configures build system, sets up CI/CD, and establishes quality tooling.
validate
Run SDLC compliance check against the current project. Validates build system, code quality, testing, CI/CD, security, documentation, VCS, and release configurations.
run-tests
Run automated functional tests using the hook-driven test framework. Execute the test suite to validate all project functionality.
test-report
Generate test execution report in markdown format.
add-test
Interactively add a new test definition to the test suite.
release-swarm
Orchestrate complex software releases using AI swarms that handle everything from changelog generation to multi-platform deployment.