triage

A scheduled repository-maintenance command that reviews issues and pull requests on a development branch each week. It can merge straightforward changes, run tests, update the changelog, and push the development branch.

In plain words
What is it for?
Use it for recurring triage: finding duplicate or out-of-scope work, merging simple changes, testing them, recording a patch-version change, and updating the development branch.
Why use it?
It reduces repetitive weekly cleanup while leaving the final decision to release the development branch to the main branch with a maintainer.

Command for Claude Code

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/phuryn/claude-usage/triage
Clone the repo
git clone --depth 1 https://github.com/phuryn/claude-usage

Made for: Claude Code.

Per session 53 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,334 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00053 $0.03334
Opus 5 $0.00026 $0.01667
Sonnet 5 $0.00011 $0.00667
Haiku 4.5 $0.00005 $0.00333

Measured 3d ago against content hash 8d6520f7ef1d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/triage.md · 203 lines

How it starts

The opening of the file, as written. The whole thing — 203 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/triage — weekly claude-usage triage

Designed to be run headless via Windows Task Scheduler (claude -p "/triage") once a week. Operates in the local working copy on the DEV branch only. Never pushes to main.

Identity & tone

  • Sign every public-facing comment with _— Claude Code & Codex collab_ on its own italicized line.
  • Mention the version that ships next (the bumped patch version, e.g. v1.1.1) in close messages so contributors know where to look.
  • Friendly, brief, honest. No emojis.
  • Never dismiss a contributor's work as "wrong" when it duplicates a landed fix — they got there independently; thank them.

Hard safety rails (do not violate)

  1. Dirty-worktree guard. Before any checkout / reset / merge, run git status --porcelain. If output is non-empty, abort immediately — there is local maintainer work the routine would otherwise destroy. Do not stash, do not --force. Exit with a self-comment (step 8) explaining why the run was skipped.
  2. Never push to main. Final release is the maintainer's call. DEV gets pushed; main never does.
  3. Never close a PR or issue opened by the repo owner (gh repo view --json owner --jq .owner.login). Those are intentional, not triageable.
  4. Never auto-merge a PR that:
    • touches more than 8 files, OR
    • has more than 200 added lines, OR
    • mentions any of these keywords in title / body / diff (security or contract-sensitive — escalate): auth, password, credential, cookie, token, secret, api key, oauth, bearer, login, permission, encrypt, session, csrf, OR
    • introduces new top-level dependencies (requirements.txt, pyproject.toml, package.json), OR
    • modifies anything under .github/workflows/, scripts/, .claude/, OR
    • includes deletions or renames of existing files (not just additions/edits), OR
    • includes a database schema change (init_db body, new CREATE TABLE, new ALTER TABLE).
  5. Never push DEV if python -m unittest discover -s tests -v fails on main first. Baseline must be green before any work.
  6. Never push DEV if the final test sweep after merges fails. Roll back, leave nothing on DEV.
  7. Stop if any external dependency is missing (gh, codex, python) — exit cleanly with a noted error rather than partial state.
  8. Codex sign-off is mechanical, not advisory. Before any gh pr close / gh issue close fires, a file at /tmp/triage-codex-signoff.md must exist containing (a) every item on the close list, and (b) the exact phrase Codex sign-off: close list approved on its own line. Codex generates this in step 2. No file → no closes. If Codex says "uncertain" on any item, that item stays open regardless.
  9. If unclear, leave it open and comment. Don't guess. Surfacing as "needs maintainer review" is always preferable to a wrong close.

Read the full file on GitHub · 203 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 203 lines · 53 tokens per session scan A 8d6520f7ef1d

Subscribe to this mod's changes

triage is a command published in the GitHub repository phuryn/claude-usage (2,185 stars, last pushed 1mo ago), licensed MIT. It adds 53 tokens to every session and 3,334 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.