merge

A command for completing a GitHub pull request (PR), a proposed set of code changes, only after checks pass and reviews are handled.

In plain words
What is it for?
Use it to inspect the current branch's PR, monitor its automated checks, address review comments, merge it, and remove the completed branch.
Why use it?
It prevents unfinished or failing changes from being merged and makes sure the repository is cleaned up afterward.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/azrtydxb/procoder/merge
Clone the repo
git clone --depth 1 https://github.com/azrtydxb/procoder
Per session 23 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,299 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00023 $0.01299
Opus 5 $0.00012 $0.00649
Sonnet 5 $0.00005 $0.00260
Haiku 4.5 $0.00002 $0.00130

Measured yesterday against content hash 4f592232df93, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

merge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.kilo/commands/merge.md · 98 lines

How it starts

The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.

The user invoked /procoder:merge with arguments: $ARGUMENTS (The argument is the PR number or branch; with none, use the PR for the current branch: gh pr view --json number.)

First read .procoder/github/WORKFLOW.md and follow it — the repo's rules win over the defaults below. If it is missing, get the default via procoder templates, write it, then follow it.

A PR merges when EVERYTHING answers — never before.

  1. Don't block on the waiting: spawn a BACKGROUND agent whose only job is to watch and report. The watcher never fixes, never replies, never merges — it gathers information; you act on it. Continue other work while it watches, and pick up the loop below each time it reports. Give the watcher the merge-watching protocol from .procoder/github/WORKFLOW.md verbatim: calibrate against previous runs of the same workflow, poll PER JOB in the foreground (gh run view <run-id> --json jobs — never a fire-and-forget monitor), report the FIRST failing job immediately with its --log-failed excerpt instead of waiting for the rest, poll dynamically (fast early and near the calibrated finish, never slower than 90s), and report on every state change.

Loop until done:

  1. Checks: gh pr checks <pr> — every required check must pass. For a failing check, open its run (gh run view <id> --log-failed), fix the cause in the code, commit, push, and wait for the re-run.

  2. Reviews: gh pr view <pr> --json reviews,reviewDecision and the review comments via gh api repos/{owner}/{repo}/pulls/<pr>/comments. Treat BOT reviewers (Copilot included) exactly like humans: read every comment and recommendation, and for each one either

    • fix it (commit, push, then reply to the thread saying what changed), or
    • reply with a concrete reason why not. No comment is skipped silently. Resolve threads only after fixing or answering (gh api graphql resolveReviewThread), never to hide them.

    How to receive review feedback — bot or human:

    • VERIFY before implementing: check each claim against the actual code. Reviewers (Copilot especially) lack full context; a finding can be factually wrong for this codebase. Wrong → push back in the thread with the technical reason, not a fix.
    • If ANY comment in a review is unclear, ask about it before implementing the others — comments are often related, and partial understanding produces the wrong fix.
    • Fix one finding at a time and re-run the covering tests after each.
    • Replies state facts: "Fixed in — ." No "great point", no thanks, no "you're absolutely right" — gratitude is not a verification, and performative agreement erodes the reviewer's trust in real agreements.
    • A reviewer asking for an unused "proper" feature gets the YAGNI answer: show it is uncalled and propose removal instead.

2b. The reflection step — MANDATORY whenever step 2 found anything real (bot or human). An escaped finding is a bug in our gates; fixing only the finding leaves its class open:

  • For each real finding, name the layer that should have caught it BEFORE the PR existed: a linter (lint baseline/config), the pre-PR rubric (.procoder/github/REVIEW.md), a quality controller, a pinning test, or CI itself.
  • ADAPT that layer now, in this same PR: enable the linter rule, add the rubric line, tighten the controller, write the pinning test.
  • Record each as an entry in .procoder/github/LESSONS.md (shape: procoder templates), with the adaptation named. Then run procoder lessons — it flags any entry left unlearned, and an unlearned lesson is not done.
  • False positives get no ledger entry — reflect only on real escapes.
  • Then run procoder copilot-leak. Copilot's auto-review sometimes opens ISSUES rather than PR comments, and those escape the reading in step 2 entirely: the finding gets fixed and nothing records that the class happened. The command finds them, strips every trace of the code from them, and asks before it files or records anything. This is the only place a procoder command talks to GitHub about reviews — the gate reads the resulting ledger offline and never queries.

Read the full file on GitHub · 98 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 98 lines · 23 tokens per session scan A 4f592232df93

Subscribe to this mod's changes

merge is a command published in the GitHub repository azrtydxb/procoder (196 stars, last pushed 2d ago), licensed Apache-2.0. It adds 23 tokens to every session and 1,299 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.