Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/s977043/river-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/s977043/river-review/merge-check)<a href="https://agentmods.dev/commands/s977043/river-review/merge-check"><img src="https://agentmods.dev/badge/commands/s977043/river-review/merge-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/s977043/river-review/merge-check"><img src="https://agentmods.dev/badge/commands/s977043/river-review/merge-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.04517 |
| Opus 5 | $0.00019 | $0.02259 |
| Sonnet 5 | $0.00008 | $0.00903 |
| Haiku 4.5 | $0.00004 | $0.00452 |
Grade A, and why
merge-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
マージ前チェック: PR #$ARGUMENTS が gh pr merge 可能な状態か、docs/governance.md § 「PR レビューとマージ」>「マージ前チェックリスト」(SSoT) の全項目を実コマンドで検証して判定する。
このスキルは gh pr merge を実行する 直前 に呼び出すことを想定している。抽象的な確認でなく、以下の検証コマンドを実際に実行して MERGE_OK / BLOCKED の判定まで行う。詳細な背景・pagination の落とし穴・disposition ルールの正は docs/governance.md にあり、本コマンドは実行手順の具体化のみを担う。
検証手順
Step 1. CI green の確認
gh pr checks $ARGUMENTS --json name,bucket,startedAt --jq 'group_by(.name) | map(if any(.[]; .bucket == "pending") then (map(select(.bucket == "pending")) | first) else max_by(.startedAt) end) | .[] | select(.bucket != "skipping")'
- 全チェックが
passバケットであることを確認する(skippingは除外可) group_by(.name)以降は同名 check のうちpendingがあればそれを、無ければstartedAtが最新の run を残す。queued の run はstartedAtがゼロ時刻(0001-01-01T00:00:00Z)で並ぶため、max_byだけでは古いcancel/passを最新と誤って採り、pendingを隠す。gh pr checksは同じ head に対する全 run(concurrency でcancelされた古い run を含む)を並べるため、これが無いと再実行済みのcancelをfailと読む(2026-09-04..05 に 3 回発生)pendingが残る場合はマージせず、完了まで待ってから再実行するfailがある場合はマージ不可。pre-existing の main 失敗でも本 PR を直接マージせず、先に main を green に戻す(governance.md § 1 参照)
Step 2. レビュアーコメントの全件列挙と disposition 確認
2 つのエンドポイントを両方実行する。 pulls/<N>/comments は line comments(差分の行に紐づくレビューコメント)しか返さず、PR 本体に投稿された通常コメント(issue comment)は issues/<N>/comments からしか取得できない。
まず、列挙そのものはスクリプトで実行する。2 系統の --paginate 取得と bot の切り分けを決定論で行い、disposition の作業リストを出力する(refs #1827)。
npm run check:comment-disposition -- $ARGUMENTS
- 終了コード 0 = 人間由来のコメントなし(Step 2 は pass)、1 = 人間由来のコメントあり(出力された各件の disposition を確定するまで pass にしない)、2 = 使い方の誤りまたは
ghの失敗 - exit 1 は「マージ禁止」ではなく「確認せよ」を意味する。disposition 済みかどうかをスクリプトは判定しない(判定できないため。理由は下記「なぜスクリプトは disposition の完了まで見ないか」)
- 人間 / bot の切り分けは GitHub API の
user.type(Bot/User)で行い、bot 名の除外リストは持たない。ただし PAT で動く自動化はuser.type: "User"を返すため、bot が人間として列挙されることがある。その場合は投稿者名で判断する - スクリプトが
ghの失敗などで exit 2 になった場合は、下記の生コマンドへフォールバックする
生コマンド(スクリプトが使えない場合、または本文全体を読みたい場合):
gh api --paginate "repos/:owner/:repo/pulls/$ARGUMENTS/comments?per_page=100" \
--jq '.[] | {id, in_reply_to_id, user: .user.login, path, line, commit: .commit_id, body}'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +1 lines 7a0784eef4fe
- 9d ago First seen · 184 lines · 39 tokens per session scan A 11a5fd70ccae
merge-check is a command published in the GitHub repository s977043/river-review (3 stars, last pushed today), licensed MIT. It adds 39 tokens to every session and 4,517 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
pr
Review a GitHub PR or GitLab MR with Punchcard and post the review into it.
merge
Finish a PR properly: every check green, every review addressed — human and bot — then merge and clean up.
pr
Prepare and open a pull request the senior way: gate, template, scrubbed, everything visible.
triage
Triages a PR comment — from a bot (Copilot, CI) or a human reviewer. Fetches the comment and diff via gh CLI, classifies it, applies the fix directly to the file if valid, posts a reply on the thread, and resolves it. Run from inside the repo.
ia-changelog
Create engaging changelogs for recent merges to main branch.
fix-pr-comments
Systematically resolve Pull Request review comments using gh CLI to fetch comments and apply requested changes.