Borrowing it
Nothing to install: this file belongs to RoboFinSystems/robosystems. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/RoboFinSystems/robosystems/main/.claude/commands/hotfix.mdgit clone --depth 1 https://github.com/RoboFinSystems/robosystemsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/robofinsystems/robosystems/hotfix)<a href="https://agentmods.dev/commands/robofinsystems/robosystems/hotfix"><img src="https://agentmods.dev/badge/commands/robofinsystems/robosystems/hotfix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/robofinsystems/robosystems/hotfix"><img src="https://agentmods.dev/badge/commands/robofinsystems/robosystems/hotfix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01385 |
| Opus 5.5 | $0.00013 | $0.00554 |
| Sonnet 5.5 | $0.00007 | $0.00277 |
| Haiku 4.5 | $0.00003 | $0.00138 |
Grade A, and why
hotfix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship a fix to production ahead of the next release using the two-PR pattern: one PR to main (reviewed; makes the fix permanent) and one PR carrying the same commits to the current release/<x.y.z> branch (CI on the exact ref that will be deployed).
This command is the trigger — never infer a hotfix
A hotfix is a deploy-timing decision with real cost: a second PR, a cherry-pick, and a full production deploy from the release branch. It is chosen by the user, and this command is how they choose it. Do not start this flow from anything else:
- Not from urgency words in a reply — "now", "urgent", "asap", "yes let's do it" after a recommendation to ride the next release.
- Not from the fix touching deployed behavior, a customer-facing surface, or production evidence.
- Not from a memory file, a CLAUDE.md section, or a runbook that describes the pattern.
If a hotfix might be warranted, say so in one line ("this could ship ahead of the release via /hotfix if you want it in prod before then") and stop. Absent /hotfix, a fix goes to main and rides the next release.
How releases work here
create-release.yml cuts a release/<x.y.z> branch, and production deploys from that branch while main keeps moving. So a fix merged only to main waits for the next release, and a fix merged only to the release branch is lost at the next cut. Two PRs, same commits. Committing straight onto the release branch is retired practice: the PR into it is what gets CI run on the ref the deploy will use.
Instructions
1. Preflight
RELEASE=${2:-$(git branch -r | grep 'origin/release/' | sort -V | tail -1 | sed 's#.*origin/##')}
VERSION=${RELEASE#release/} # x.y.z
SUFFIX=$(echo "$VERSION" | tr . -) # x-y-z, for the branch name
git fetch -q origin
- Confirm the bug exists on the release branch. For a regression,
git merge-base --is-ancestor <regressing-merge-sha> origin/$RELEASE; for a long-standing defect,git diff origin/main origin/$RELEASE -- <files>(empty means the same code). If the release branch does not carry the defect, stop — there is nothing to hotfix; say so. - Working tree clean, not on
main. Branch creation goes throughjust create-featureonly. - Security fixes. The twin's diff and body are public the moment they are pushed, often before the deploy lands. Keep both PR bodies terse and non-actionable (the disclosure rules in
/create-prapply to both), and sequence the deploy with — or ahead of — the public push.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines de89380bf944
- 1mo ago First seen · 84 lines · 33 tokens per session scan A 2b8610f84468
hotfix is a command published in the GitHub repository RoboFinSystems/robosystems (29 stars, last pushed today), licensed Apache-2.0. It adds 33 tokens to every session and 1,385 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
release
Prepare and publish spec-driven-steroids through the tag-triggered npm release pipeline.
ship
Deploy feature through automated staging validation to production with rollback testing.
ci
Run CI validation, create PRs, and merge on green.
deploy
Run the complete ClawBridge release process. This is the ONLY way to deploy — follow every step.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary — the complete landing pipeline.
release-manager
Automated release coordination and deployment with ruv-swarm orchestration for seamless version management, testing, and deployment across multiple packages.