setup

A guided setup command for tlive, a tool that connects coding-agent sessions to messaging channels. It checks the installation, channel configuration, plugins, incoming messages, command menus, and desktop notifications.

In plain words
What is it for?
Use it to install or verify tlive, check bundled integrations, test that a bot receives and answers messages, confirm available commands, and understand notification behavior.
Why use it?
It replaces guesswork with a sequence of checks that shows whether the messaging connection really works. It also distinguishes an idle service from one that has no channels configured.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/y49/tlive/setup
Clone the repo
git clone --depth 1 https://github.com/y49/tlive
Per session 13 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 996 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00013 $0.00996
Opus 5 $0.00006 $0.00498
Sonnet 5 $0.00003 $0.00199
Haiku 4.5 $0.00001 $0.00100

Measured yesterday against content hash b631ab368d9e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

setup scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Harvests environment variableshighData exfiltration

Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.

collect credentials per platform:
plugins/claude/plugins/tlive/commands/setup.md · 69 lines

What it actually says

Guide the user through tlive setup. Execute in order, showing each result:

  1. Run tlive status. If the command is missing → tell the user to install the engine first: npm i -g tlive, then re-run this command.

  2. Read the output: an idle daemon is fine (sessions auto-start it); what matters is whether channels says (none).

  3. Already configured (channels present)? Don't just say "all set" — run the verification tour instead, one check at a time with its result: a. plugins: lines show the bundled version with a ✓ for every installed vendor (a mismatch → tlive setup --hooks-only). b. Have the user send the bot a message and confirm the reply arrives (proves the inbound path, not just the config). c. Ask the user to check the bot's command menu shows /mute /trust /safe /mode /help (a stale client cache → close and reopen the chat). d. Desktop notifications: explain one fires per thing that needs you to act — a pending approval, or the idle "waiting for your input" nudge — and tlive never touches it again afterward; it just ages into the notification centre like any other app's, so that's a log, not a live status board (open the dashboard for what's waiting right now). A finished turn notifies the desktop too, after the same grace as the IM card; tool failures stay on IM, since they block nobody. There is no separate on/off switch: use the OS's Do Not Disturb to silence them temporarily, or tlive mode off to stop tlive entirely. e. Hand out the dashboard via tlive url; suggest opening it once. f. Offer optional next steps: add another channel (continue below), or stop here. Then skip to step 8 unless the user wants a new channel.

  4. If no channel (or adding one): ask whether the user wants Telegram, Feishu, or both, and collect credentials per platform:

    • Telegram: bot token (create via @BotFather) + chat id (send the bot a message and read getUpdates, or the user already knows it)
    • Feishu: appId + appSecret (self-built app on the open platform with im message permissions)
  5. Read ~/.tlive/config.json (may be absent or partial) and MERGE the new fields in (preserve existing ones):

    { "allowedSenders": [],
      "adapters": {
        "telegram": { "token": "<token>", "chatIdAllowList": ["<chatId>"] },
        "feishu": { "appId": "<appId>", "appSecret": "<secret>" } } }
    

    (Only write the platforms the user chose; validate the JSON.)

  6. tlive stop (if running) then tlive start, then tlive status to confirm the configured platforms appear under channels.

  7. Have the user send the bot a test message; hand out the dashboard address via tlive url.

  8. Offer remote approval. tlive defaults to notify (watch + notify only — it never holds a tool call, so a fresh install can't hang a workflow). Ask whether the user wants to Allow/Deny tool calls from their phone; if yes, run tlive mode full (holds each tool call for a remote answer, in parallel with the local prompt — first answer wins; revert any time with tlive mode notify). If they only want monitoring, leave it in notify. If they also want sub-agent approvals on their phone (e.g. they're about to step away), that's tlive mode all — flag the trade: a held sub-agent has no terminal dialog until the window ends, so it only pays off when nobody is at the keyboard (tlive mode full goes back).

  9. If status shows the Codex companion as off or degraded, explain what it means (codex missing from PATH / nothing answering on the app-server socket — see ~/.tlive/codex-appserver.log); Codex approvals stay local-only until it is running. There is no trust step to perform, and no restart either: tlive keeps checking, so installing codex clears it on its own.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 69 lines · 13 tokens per session scan C b631ab368d9e

Subscribe to this mod's changes

setup is a command published in the GitHub repository y49/tlive (206 stars, last pushed 11d ago), licensed MIT. It adds 13 tokens to every session and 996 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.