vbw:todo

vbw:todo is a command for Claude Code from swt-labs/vibe-better-with-claude-code-vbw. It costs 16 tokens per session (1,688 once invoked), scanned A, original, MIT.

A command that adds a task to the project's saved backlog in STATE.md, with an optional priority. A backlog is a list of work items waiting to be done.

In plain words
What is it for?
Use it to record a new project task and mark it as high, normal, or low priority.
Why use it?
It keeps future work in one persistent place instead of relying on memory or temporary notes.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: mentions CLAUDE.md.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the vbw plugin — 11 skills, 26 commands, 7 agents, 11 hooks shipped together

Good fit Use it to record a new project task and mark it as high, normal, or low priority.

Compare 6 commands from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add swt-labs/vibe-better-with-claude-code-vbw
Claude Code
/plugin install vbw

Made for: Claude Code.

Or install vbw, the plugin that ships this one along with the rest of its 11 skills, 26 commands, 7 agents, 11 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for vbw:todo

README.md
[![agentmods](https://agentmods.dev/badge/commands/swt-labs/vibe-better-with-claude-code-vbw/todo/github.svg)](https://agentmods.dev/commands/swt-labs/vibe-better-with-claude-code-vbw/todo)
Your own site
<a href="https://agentmods.dev/commands/swt-labs/vibe-better-with-claude-code-vbw/todo"><img src="https://agentmods.dev/badge/commands/swt-labs/vibe-better-with-claude-code-vbw/todo/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for vbw:todo

Your own site · 80×15
<a href="https://agentmods.dev/commands/swt-labs/vibe-better-with-claude-code-vbw/todo"><img src="https://agentmods.dev/badge/commands/swt-labs/vibe-better-with-claude-code-vbw/todo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 16 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,688 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00016 $0.01688
Opus 5 $0.00008 $0.00844
Sonnet 5 $0.00003 $0.00338
Haiku 4.5 $0.00002 $0.00169

Measured 9d ago against content hash 6cdf1f6a1768, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

vbw:todo scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/todo.md · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

VBW Todo: $ARGUMENTS

Context

  • Working directory: current workspace root.
  • Plugin cache root: "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/plugins/cache/vbw-marketplace/vbw" (respects non-default CLAUDE_CONFIG_DIR; always quote — path may contain spaces).

Guard

  1. Not initialized (no .vbw-planning/ dir): STOP "Run /vbw:init first."
  2. Missing description: STOP: Usage: /vbw:todo <description> [--priority=high|normal|low]
  3. Restricted mode: If the current permission mode does not allow both Bash and edits, STOP: "/vbw:todo needs Bash plus write access to update .vbw-planning/STATE.md and run the planning git boundary. If you're in read-only or another restricted mode, switch to a mode that allows both and rerun the command."

Steps

  1. Resolve context: Always use .vbw-planning/STATE.md for todos — project-level data lives at the root, not in milestone subdirectories. If .vbw-planning/STATE.md does not exist, STOP: "STATE.md not found. Session startup normally recovers archived state automatically — try restarting your Claude session, or run /vbw:init to set up your project."
  2. Parse args: Description (non-flag text), --priority (default: normal). Format: high=[HIGH], normal=plain, low=[low]. Append (added {YYYY-MM-DD}).
  3. Add plain todo to STATE.md: Find ## Todos section. Replace "None." / placeholder or append after last item.
  4. Resolve plugin root. Determine the plugin root path for helper-backed follow-up work. Always quote derived paths (they may contain spaces). Try in order: (a) The local/ subdirectory under the plugin cache root (i.e. "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/plugins/cache/vbw-marketplace/vbw/local/"), if it exists and contains scripts/hook-wrapper.sh. (b) The numerically highest versioned directory under the plugin cache root — list subdirectories matching a dotted-version pattern (e.g. 1.30.0), sort by each numeric component (major, minor, patch), pick the highest, and accept it only if it contains scripts/hook-wrapper.sh. (c) Any other (non-versioned) subdirectory under the plugin cache root — pick the newest by name, accept only if it contains scripts/hook-wrapper.sh. This covers non-standard cache layouts. (d) The session symlink /tmp/.vbw-plugin-root-link-${CLAUDE_SESSION_ID:-default}, or any existing /tmp/.vbw-plugin-root-link-* symlink whose target contains scripts/hook-wrapper.sh. (e) Extract --plugin-dir <path> from the process tree (ps axww) and use that path if it contains scripts/hook-wrapper.sh. Store the resolved path as PLUGIN_ROOT for subsequent helper calls. If none of the fallbacks resolve, leave PLUGIN_ROOT empty and continue — extended detail and the planning git boundary will degrade gracefully later.
  5. Capture extended detail (conditional). Check whether the description from step 2 contains any of these: file paths, reproduction steps, stack traces, code references, error messages, or multi-sentence design rationale. Only evaluate the current $ARGUMENTS text — do not scan prior conversation history.
    • If triggered: The todo has rich context worth preserving for later execution.
      1. If PLUGIN_ROOT is empty, leave the plain todo line from step 3 unchanged, do not append a ref tag, do not write .vbw-planning/todo-details/HASH.json yourself, and continue to step 6 with a warning that extended detail was not saved.
      2. Extract a brief one-line summary (first sentence or the user's explicit title) — this is already the STATE.md bullet text from step 3.
      3. Compute a hash: printf '%s' "<summary text>" | shasum | cut -c1-8
      4. Build a JSON detail object: {"summary": "<brief summary>", "context": "<full description, max 2000 chars>", "files": ["<any file paths mentioned>"], "added": "<YYYY-MM-DD>", "source": "user"}
      5. Store it through the canonical helper — pipe JSON via heredoc to avoid shell-quoting issues with apostrophes or special characters in user text:
        bash "${PLUGIN_ROOT}/scripts/todo-details.sh" add HASH - <<'DETAIL_JSON'
        <json>
        DETAIL_JSON
        
      6. Parse the helper's stdout JSON. Only when the parsed stdout is valid JSON with status="ok" may you:
        • edit the exact todo line you just added in STATE.md to append (ref:HASH) after the (added YYYY-MM-DD) tag
        • later report Extended detail saved (ref:HASH).
      7. If the helper's stdout is not valid JSON or the parsed status is anything other than ok, leave the plain todo line from step 3 unchanged, do not append a ref tag, and do not write .vbw-planning/todo-details/HASH.json yourself.
    • If not triggered (simple one-liner with no structural context): skip — no ref tag, no detail storage. Brief bullets keep STATE.md scannable and token-efficient for context compilation. The detail file preserves context that would otherwise be lost when the todo is executed in a later session.
  6. Run planning git boundary. This step only happens after the plain STATE.md write from step 3 succeeded. For simple one-line todos, run it after step 3 using the shared PLUGIN_ROOT from step 4. For rich-detail todos, run it only after step 5 completes — after the (ref:HASH) update on detail-save success, or after the failed-detail/no-ref branch on helper failure. If PLUGIN_ROOT is non-empty and ${PLUGIN_ROOT}/scripts/planning-git.sh exists, run:
    bash "${PLUGIN_ROOT}/scripts/planning-git.sh" commit-boundary "add todo item" .vbw-planning/config.json
    
    If PLUGIN_ROOT is empty or the helper is unavailable, keep the todo write intact and warn with the literal existing message:
    VBW: planning-git.sh unavailable; skipping planning git boundary commit
    
    Do not add bespoke staging, commit, or push logic here — the helper owns that behavior.
    • planning_tracking=commit: the helper stages .vbw-planning/ + CLAUDE.md and commits if there are changes.
    • planning_tracking=manual|ignore: the helper no-ops.
    • auto_push=always: the helper pushes when the branch already has an upstream.
  7. Confirm: Display ✓ + formatted item + Next Up (/vbw:status). If detail was captured successfully after step 5.6, also display: Extended detail saved (ref:HASH). If step 5 triggered but helper-backed storage did not succeed, warn that the plain todo was added but extended detail was not saved. If step 6 emitted the planning-git warning, surface it too.

Read the full file on GitHub · 69 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 69 lines · 16 tokens per session scan A 6cdf1f6a1768

Subscribe to this mod's changes

vbw:todo is a command published in the GitHub repository swt-labs/vibe-better-with-claude-code-vbw (79 stars, last pushed 2mo ago), licensed MIT. It adds 16 tokens to every session and 1,688 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.