Borrowing it
Nothing to install: this file belongs to cognitx-leyton/codegraph. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/cognitx-leyton/codegraph/main/.claude/commands/sync.mdgit clone --depth 1 https://github.com/cognitx-leyton/codegraphWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/cognitx-leyton/codegraph/sync)<a href="https://agentmods.dev/commands/cognitx-leyton/codegraph/sync"><img src="https://agentmods.dev/badge/commands/cognitx-leyton/codegraph/sync/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/cognitx-leyton/codegraph/sync"><img src="https://agentmods.dev/badge/commands/cognitx-leyton/codegraph/sync.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.00477 |
| Opus 5.5 | $0.00007 | $0.00191 |
| Sonnet 5.5 | $0.00003 | $0.00095 |
| Haiku 4.5 | $0.00002 | $0.00048 |
Grade A, and why
sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Sync Branches (standalone utility — not part of the workflow)
PR: $ARGUMENTS (if empty, finds the most recent merged PR)
After you approve and merge a PR into hotfix, run this to propagate changes to the other branches.
Branch flow
hotfix (receives PRs from feature branches)
↓ sync
dev (development branch)
↓ sync
main (stable reference)
↓ sync
release (release branch)
Process
1. Find the merged PR
# If argument given, use it. Otherwise find most recent merged PR to hotfix.
gh pr list --base hotfix --state merged --limit 1
2. Fetch latest
git fetch origin
3. Sync dev to hotfix
git checkout dev
git pull origin dev
git merge origin/hotfix --no-edit
git push origin dev
4. Sync main to dev
git checkout main
git pull origin main
git merge origin/dev --no-edit
git push origin main
5. Sync release to main
git checkout release
git pull origin release
git merge origin/main --no-edit
git push origin release
6. Return to dev
git checkout dev
7. Report
Branches Synced
---------------
┌──────────┬──────────┬─────────────────┐
│ Branch │ SHA │ State │
├──────────┼──────────┼─────────────────┤
│ hotfix │ {sha} │ ← PR merged │
│ dev │ {sha} │ ← synced │
│ main │ {sha} │ ← synced │
│ release │ {sha} │ ← synced │
└──────────┴──────────┴─────────────────┘
Done. All branches contain the latest work.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 89 lines · 17 tokens per session scan A f34ca161b77c
sync is a command published in the GitHub repository cognitx-leyton/codegraph (12 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 17 tokens to every session and 477 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
review
Architecture-aware code review with Pharaoh.
feedback
A design-stage security review for product requirement documents and other planning documents; a PRD is a document describing what a product should do.
va
A read-only security review of a codebase across eight architecture areas, with findings checked against file-and-line evidence.
compliance
A follow-up security check that verifies whether earlier findings were fixed and, depending on the selected mode, looks for new problems.
pentest
A read-only penetration-testing command for examining source code from an attacker’s perspective and producing proof-of-concept checks. Penetration testing is authorized security testing that tries to verify exploitable weaknesses.
run
A security-workflow coordinator that turns a natural-language request into a plan involving code review, verification, attack testing, or reporting.