Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/coddy-project/coddy-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/coddy-project/coddy-agent/merged-branch-cleanup)<a href="https://agentmods.dev/rules/coddy-project/coddy-agent/merged-branch-cleanup"><img src="https://agentmods.dev/badge/rules/coddy-project/coddy-agent/merged-branch-cleanup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/coddy-project/coddy-agent/merged-branch-cleanup"><img src="https://agentmods.dev/badge/rules/coddy-project/coddy-agent/merged-branch-cleanup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00931 | $0.00931 |
| Opus 5.5 | $0.00372 | $0.00372 |
| Sonnet 5.5 | $0.00186 | $0.00186 |
| Haiku 4.5 | $0.00093 | $0.00093 |
Grade A, and why
merged-branch-cleanup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cleanup after a merge
A branch whose pull request has merged is finished, and its worktree and the branch itself are
removed in the same session, as the last step of the merge rather than later. A worktree left
behind keeps a checkout, a node_modules and a build cache on the disk; a branch left behind is
where the next agent commits a follow-up that no pull request will ever pick up.
When it applies
As soon as you know that the pull request of a branch you worked on has merged: you merged it
(Merging the pull request in the workflow rule), the operator says so, or
gh pr view <PR> --json state reports MERGED. It covers a worktree a host made for the session
(.claude/worktrees/, .coddy/worktrees/ and the like) as much as one made by hand, and the
isolated site-repository worktree once its commit is pushed.
A branch that reached main by a direct push, with no pull request, is finished the same way once
the push is confirmed. Step 1 then checks it against main instead of a pull request
(git -C <main checkout> fetch origin, then
git -C <main checkout> merge-base --is-ancestor <branch> origin/main), and step 4 has nothing to
delete unless the branch itself was pushed.
A merged branch is never reused: a follow-up starts a new branch from current origin/main.
Steps
Run them from the main checkout (the first line of git worktree list) with git -C: the worktree
being removed may be the session's own working directory, which is gone after step 2.
- Make sure nothing is lost:
git -C <worktree> status --porcelainprints nothing. Uncommitted or untracked files stop the cleanup: show them to the operator and wait, and never rungit worktree remove --forcewithout the operator's word. Ignored files (build output,node_modules) go with the worktree;- every commit of the branch reached the pull request:
git -C <main checkout> fetch origin pull/<PR>/head, thengit -C <main checkout> merge-base --is-ancestor <branch> FETCH_HEADsucceeds (FETCH_HEADbelongs to the worktree that fetched, so both run in the same one). A commit made after the merge stops the cleanup the same way: it goes to a new branch and a new pull request first.
- Remove the worktree:
git -C <main checkout> worktree remove <worktree>, thengit -C <main checkout> worktree prune. - Delete the local branch:
git -C <main checkout> branch -D <branch>. It is-Dand not-dbecause a squash or rebase merge leaves the branch's own commits out ofmain, and-drefuses such a branch; the ancestry check of step 1 is what makes-Dsafe. - Delete the branch on origin. GitHub deletes the head branch of a merged pull request by itself
(
delete_branch_on_mergeis on for this repository), so this step is usually a check thatgit ls-remote --exit-code --heads origin <branch>finds nothing. When it finds the branch (the setting was off, or the merge was a local push), rungit push origin --delete <branch>. A pull request from a fork has no branch on origin, and the fork's branch belongs to its author: leave it. - Drop the stale remote-tracking ref:
git -C <main checkout> fetch --prune origin.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 62 lines · 931 tokens per session scan A 09d6a9fd5241
merged-branch-cleanup is a cursor rule published in the GitHub repository coddy-project/coddy-agent (175 stars, last pushed today), licensed MIT. It adds 931 tokens to every session, about $0.0037 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.
Other cursor rules, from other repositories
go
Cursor rule "go" from tomasz-tomczyk/crit, covering go code rules (semantic — linters handle syntax/style), struct & state integrity, code organization, git operations and daemon/server.
no-co-author-trailers
Never add Co-authored-by or other AI/tool trailers to git commits or PRs.
sciclaw-papercuts
Papercuts from Sol/ImageMagick/release cycles — release, brew, CI, and workspace hygiene for sciClaw agents.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.