Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/dean0x/devflow/releasegit clone --depth 1 https://github.com/dean0x/devflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00006 | $0.02410 |
| Opus 5 | $0.00003 | $0.01205 |
| Sonnet 5 | $0.00001 | $0.00482 |
| Haiku 4.5 | $0.00001 | $0.00241 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release Command
Release the project using adaptive learned configuration. On first run, scans the codebase to detect the release process and stores it in .release/RELEASE-FLOW.md. Subsequent releases use the stored config, skipping discovery.
Usage
/release v1.2.3 (explicit version)
/release patch (bump type: patch | minor | major)
/release --dry-run (simulate release, show plan without executing)
/release (interactive: ask for version)
Input
$ARGUMENTS contains whatever follows /release:
- Explicit version:
v1.2.3or1.2.3 - Bump type:
patch,minor,major - Flag:
--dry-run - Empty: interactive mode (will ask for version)
Parse from $ARGUMENTS:
VERSION: explicit version string if present (strip leadingv)BUMP_TYPE:patch | minor | majorif bump type providedDRY_RUN: true if--dry-runpresent, false otherwise
Phases
Phase 1: Load Config
Produces: RELEASE_CONFIG, CONFIG_STATE (learned | fresh)
Load Companion Skills — Load via Skill tool: devflow:git. If a skill fails to load, continue without it.
Continuation detection: Check .release/.progress.json. If exists, an interrupted release is in progress. Offer user:
- Resume: continue from last checkpoint (skip phases already completed)
- Restart: clean start (delete
.release/.progress.jsonand begin from Phase 1)
Read .release/RELEASE-FLOW.md:
- If exists → parse as structured config, set CONFIG_STATE = learned, skip to Phase 4
- If missing → set CONFIG_STATE = fresh, continue to Phase 2
Phase 1b: Load Context
Produces: DECISIONS_CONTEXT, FEATURE_KNOWLEDGE
Read .devflow/learning/index.md. If the file is absent or empty, set DECISIONS_CONTEXT to (none); otherwise use the file content as DECISIONS_CONTEXT.
Load feature knowledge: Attempt to read .devflow/features/index.md (the regenerable cache). If absent or empty, glob .devflow/features/*/KNOWLEDGE.md and read each file's YAML frontmatter (name, description, directories) as the relevance surface. Pick release-relevant KBs by matching their documented area against the release context. For each selected KB, read the full KNOWLEDGE.md — trust current code over KB content on any mismatch. Concatenate under slug headers and set FEATURE_KNOWLEDGE (or (none) if no KBs exist or none are relevant). No index.json, no subprocess, no .cjs script.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 207 lines · 6 tokens per session scan A 5f0d5b6eb167
release is a command published in the GitHub repository dean0x/devflow (19 stars, last pushed yesterday), licensed MIT. It adds 6 tokens to every session and 2,410 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.