rdocx: Command for Claude Code

.claude/commands/release.md

release is a command for Claude Code from tensorbee/rdocx. It costs 40 tokens per session (2,058 once invoked), scanned A, original, MIT.

A release command for publishing an already reviewed Rust and Python package family from the exact main-branch commit produced when a sprint is closed. Rust is a programming language and Python is another programming language; the command creates the family tag and starts publication to their package registries.

In plain words
What is it for?
Use it to release the selected rdocx or rpptx package family, create or push its version tag, and start publication to crates.io and PyPI.
Why use it?
It limits releases to prepared, reviewed versions and keeps version checks, tags, and registry publication under one controlled step. It does not edit versions or merge branches.

Command for Claude Code

Written for Claude Code: installed under .claude/.

This is tensorbee/rdocx's own configuration. It tells Claude Code how to work on rdocx itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything rdocx configures →

Reuse

Borrowing it

Nothing to install: this file belongs to tensorbee/rdocx. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/tensorbee/rdocx/main/.claude/commands/release.md
Clone the repo
git clone --depth 1 https://github.com/tensorbee/rdocx

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for release

README.md
[![agentmods](https://agentmods.dev/badge/commands/tensorbee/rdocx/release/github.svg)](https://agentmods.dev/commands/tensorbee/rdocx/release)
Your own site
<a href="https://agentmods.dev/commands/tensorbee/rdocx/release"><img src="https://agentmods.dev/badge/commands/tensorbee/rdocx/release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for release

Your own site · 80×15
<a href="https://agentmods.dev/commands/tensorbee/rdocx/release"><img src="https://agentmods.dev/badge/commands/tensorbee/rdocx/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 40 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,058 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00040 $0.02058
Opus 5.5 $0.00016 $0.00823
Sonnet 5.5 $0.00008 $0.00412
Haiku 4.5 $0.00004 $0.00206

Measured 11d ago against content hash 112e51097c84, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/release.md · 150 lines

How it starts

The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/release {vX.Y.Z | rpptx-vX.Y.Z}

Release one complete Rust, CLI and Python family from the exact main merge commit produced by /close-sprint. This command alone may create or push a release tag or start crates.io and PyPI publication. It never edits versions, merges branches, or creates a sprint tag. Historical py-* tags remain immutable and readable, but cannot start a new publication.

Family contract

For vX.Y.Z, the selected crates.io set is exactly rdocx-opc, rdocx-oxml, rdocx-layout, rdocx-html, rdocx-pdf, rdocx, and rdocx-cli. The selected Python project is rdocx from rdocx-py. For rpptx-vX.Y.Z, the selected crates.io set is exactly oxml-core, oxml-opc, oxml-media, oxml-layout, oxml-drawing, oxml-pdf, oxml-sml, oxml-cli-support, oxml-chart, rpptx-oxml, rpptx-chart, rpptx-layout, rpptx-render, rpptx, and rpptx-cli. The selected Python project is rpptx from rpptx-py. The exact selected Rust manifests, workspace dependency pins when present, binding crate and pyproject.toml version must match X.Y.Z. Binding and WASM crates are not published to crates.io. Each release contains six selected CLI archives, six cp39-abi3 wheels, one source distribution and one SHA256SUMS covering all thirteen payloads.

Preconditions

Refuse before any tag or push if one check fails:

  1. The argument is exactly vX.Y.Z or rpptx-vX.Y.Z, with no suffix or extra prefix. Run python3 scripts/sprint_workflow.py unified-release-family <requested-tag> and inspect all selected version carriers and exact package allowlists.
  2. The current branch is clean main, at the same SHA as origin/main. The sprint that prepared this release has already closed through /close-sprint, and its sNN tag points to this exact merge commit. The selected release preparation F-ID is done in the sprint delivery records and its plan is completed. All its dependencies are done.
  3. The committed sprint review is clean at the reviewed sprint SHA and the /close-sprint report records the merge. Compare the merge commit tree with that reviewed sprint tree. Only the reviewed close-sprint tracker summary may differ. Refuse a material source, release-workflow, command, changelog, manifest, lockfile, or HLD difference. Do not run /sprint-review on main, because that command writes tracked review files.
  4. Consume the closed sprint's authenticated full verification at producer H and its validated completion/review metadata at R when this clean main merge M has exactly R's Git tree and all relevant tools, oracle inputs, configuration and retained artifacts remain unchanged. Use the existing closure_evidence_problems(load(sprint), reviewed_R) check and step3's actual main/review tree comparison. Current clean main, origin/main and sprint tag identities remain required. Record H, R and M truthfully. Do not claim the commands ran at M or repeat them merely because merging changed the commit SHA. No new cache service or command bridge is needed. A latest failed full attempt blocks reuse of an older green one. Missing evidence, a material tree delta or changed inputs requires the missing or invalidated gates. Both requested families reuse this common applicable full evidence. Fresh registry, publisher and approval checks remain due.
  5. Run python3 scripts/sprint_workflow.py release-notes <requested-tag> --check, render the exact CHANGELOG.md body, and inspect the family-only claims, compatibility guidance, included issue and pull-request links, and authenticated contributor credit. Rebuild the selected contribution inventory from reviewed evidence.
  6. Consume the actual locally patched publication dry run included in step4's applicable full evidence, with its retained verified archives and exact 22-package union below10MiB. Do not execute it a second time. Confirm the selected family's crates.io versions and PyPI version are freshly absent. A duplicate or partial prior publication is a failed release.
  7. Inspect .github/workflows/wheels.yml. Its tag path must select exactly one Rust allowlist, one CLI binary, and one Python distribution, validate six CLI archives and seven Python artifacts, verify their provenance, publish through the pypi environment and create one GitHub release only after both registries succeed. The PyPI trusted publisher for the selected project must identify this repository, wheels.yml, and environment pypi, with no long-lived token.
  8. Fetch the remote tag namespaces. The requested tag must be absent locally and on origin. Confirm the selected crates.io and PyPI owner or maintainer roles that will be checked after publication.

Read the full file on GitHub · 150 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago Changed · +10 lines 112e51097c84
  2. 26d ago First seen · 140 lines · 40 tokens per session scan A 707c382ee471

Subscribe to this mod's changes

release is a command published in the GitHub repository tensorbee/rdocx (44 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 2,058 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-04.