leo: Command for Claude Code

.claude/commands/review-next.md

review-next is a command for Claude Code from blackpaw-studio/leo. It costs 32 tokens per session (2,022 once invoked), scanned A, original, MIT.

A one-pass workflow for reviewing the next open pull request in a project queue. A pull request is a proposed code change waiting for review before it is merged.

In plain words
What is it for?
It is for finding the next item marked In Review, checking CI and the code, and requesting changes or automatically merging when allowed.
Why use it?
It checks the required status and review conditions so the reviewer can decide whether to request changes or merge the pull request.

Command for Claude Code

Written for Claude Code: installed under .claude/. Also seen: mentions CLAUDE.md.

This is blackpaw-studio/leo's own configuration. It tells Claude Code how to work on leo itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything leo configures →

Reuse

Borrowing it

Nothing to install: this file belongs to blackpaw-studio/leo. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/blackpaw-studio/leo/main/.claude/commands/review-next.md
Clone the repo
git clone --depth 1 https://github.com/blackpaw-studio/leo

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-next

README.md
[![agentmods](https://agentmods.dev/badge/commands/blackpaw-studio/leo/review-next.svg)](https://agentmods.dev/commands/blackpaw-studio/leo/review-next)
Your own site
<a href="https://agentmods.dev/commands/blackpaw-studio/leo/review-next"><img src="https://agentmods.dev/badge/commands/blackpaw-studio/leo/review-next.svg" alt="Measured on agentmods" height="20"></a>
Per session 32 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,022 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00032 $0.02022
Opus 5 $0.00016 $0.01011
Sonnet 5 $0.00006 $0.00404
Haiku 4.5 $0.00003 $0.00202

Measured 8d ago against content hash 19cabb6eebde, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

review-next scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/review-next.md · 219 lines

How it starts

The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/review-next — one iteration of the Leo kanban review loop

You are the reviewer agent. A separate builder agent runs /work-next. Your job starts when a PR is open and a card sits in In Review.

Like /work-next, this is one iteration. A human wraps it in /loop Nm /review-next. Do not loop inside this command.

Prerequisites

  • gh CLI authenticated with project + repo scopes
  • Write access to blackpaw-studio/leo
  • Branch protection on main either off, or the token is in an allow list

Run and sanity-check:

gh auth status
gh repo view blackpaw-studio/leo --json defaultBranchRef

Constants

  • Project number: 3
  • Project owner: blackpaw-studio (org)
  • Repo: blackpaw-studio/leo
  • Merge strategy: squash
  • CI must be: green (all required checks passed)
  • Review state file: ~/.leo/state/review-next-cursor.json — tracks the last reviewed HEAD sha per PR to avoid re-reviewing an unchanged PR

Gather the queue

  1. Pull project items where Status = In Review:
    gh project item-list 3 --owner blackpaw-studio --format json --limit 50
    
  2. For each item, follow the linked PR. If the item has no open PR, log it and skip.
  3. Sort PRs by updated_at ascending (oldest first — fairness).

If the queue is empty: print no PRs to review and exit 0.

Pick one PR

Take the oldest. Call it $PR. Capture:

  • PR number, head sha, base branch, head branch
  • title, body
  • linked issue number (from Closes #N in body or the card link)
  • mergeable state, mergeStateStatus
  • file list + diff (gh pr diff $PR --repo blackpaw-studio/leo)
  • CI status: gh pr checks $PR --repo blackpaw-studio/leo --json
  • existing reviews and review comments

State machine — exactly one branch executes

1. PR is a draft

Skip. Move on to the next PR. If none left, exit.

2. PR has label agent-skip or do-not-merge

Skip.

3. PR is not mergeable (conflicts)

Attempt a merge of origin/main into the PR branch:

Read the full file on GitHub · 219 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 219 lines · 32 tokens per session scan A 19cabb6eebde

Subscribe to this mod's changes

review-next is a command published in the GitHub repository blackpaw-studio/leo (5 stars, last pushed today), licensed MIT. It adds 32 tokens to every session and 2,022 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.