onboard

A guided setup command for Cloudone, a tool that launches additional coding sessions. It asks how those sessions should open and which local model service and model to use, then saves the choices.

In plain words
What is it for?
Use it to choose a terminal, tmux, or custom launcher, connect Cloudone to a local model backend, select a model, and optionally install its example harness.
Why use it?
It removes the need to create the configuration file by hand and applies each setup choice as you make it.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/pcvelz/cloudone/onboard
Clone the repo
git clone --depth 1 https://github.com/pcvelz/cloudone
Per session 54 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,563 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00054 $0.02563
Opus 5 $0.00027 $0.01282
Sonnet 5 $0.00011 $0.00513
Haiku 4.5 $0.00005 $0.00256

Measured yesterday against content hash 1b0eed20c40f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

onboard scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

`~/.claude/settings.json` or a project `settings.json` — that is the user's

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

5. **Verify before continuing:** `curl <url>/v1/models` must return the model.
commands/onboard.md · 219 lines

How it starts

The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Cloudone Onboarding

Walk the user through cloudone's setup one question at a time. For each answer, immediately write the resulting configuration — no deferred "now apply this yourself" summary.

Ground rules:

  • Each step is a genuine choice; "skip" always means write nothing for that step.
  • If ~/.claude/cloudone/config.json already exists with different content than you are about to write, stop, show the difference, and let the user decide (keep / overwrite / adjust) before writing.
  • NEVER commit anything.

Step 1: How should side sessions launch?

AskUserQuestion:
  question: "How should cloudone open a spawned side session?"
  header: "Launcher"
  multiSelect: false
  options:
    - label: "New terminal window (Recommended)"
      description: "Opens a fresh macOS Terminal.app window running the side session. Zero setup, visible progress, close the window to kill the session."
    - label: "tmux session"
      description: "Detached tmux session named cloudone-<timestamp>. For terminal-multiplexer users; attach with 'tmux attach'. Requires tmux installed."
    - label: "Custom bootstrap command"
      description: "You provide the launch command template; cloudone substitutes {LAUNCHER} with the path of a generated launch script. For iTerm2, kitty, SSH targets, etc."

If "Custom": ask free-form for the template (explain {LAUNCHER}, e.g. open -a iTerm {LAUNCHER}), and store it as customCommand. Otherwise customCommand stays "".

Step 2: Which local backend?

One-line intro first: cloudone starts real Claude Code sessions against ANY Anthropic-compatible URL — typically llama-swap (recommended: model auto-swapping, one stable URL) or a bare llama.cpp server. The URL is the only thing cloudone needs; the README's "Local backend setup" section covers installing either.

AskUserQuestion:
  question: "What serves your local model?"
  header: "Backend"
  multiSelect: false
  options:
    - label: "llama-swap (Recommended)"
      description: "llama-swap proxy (default http://localhost:8001). I'll fetch its model list so you can pick a model next."
    - label: "I just have a URL"
      description: "Any Anthropic-compatible endpoint (bare llama.cpp server, remote box, custom proxy). You paste the URL; model selection is skipped (the endpoint's default model is used)."
    - label: "I don't have one yet — set it up with me"
      description: "No local model server running. I'll walk you through installing one now, then continue onboarding with the URL it produces."

Read the full file on GitHub · 219 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 219 lines · 54 tokens per session scan B 1b0eed20c40f

Subscribe to this mod's changes

onboard is a command published in the GitHub repository pcvelz/cloudone (1 stars, last pushed 19d ago), licensed MIT. It adds 54 tokens to every session and 2,563 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.