Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/y49/tlive/setupgit clone --depth 1 https://github.com/y49/tliveWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00013 | $0.00996 |
| Opus 5 | $0.00006 | $0.00498 |
| Sonnet 5 | $0.00003 | $0.00199 |
| Haiku 4.5 | $0.00001 | $0.00100 |
Grade C, and why
setup scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
collect credentials per platform: What it actually says
Guide the user through tlive setup. Execute in order, showing each result:
-
Run
tlive status. If the command is missing → tell the user to install the engine first:npm i -g tlive, then re-run this command. -
Read the output: an idle daemon is fine (sessions auto-start it); what matters is whether channels says
(none). -
Already configured (channels present)? Don't just say "all set" — run the verification tour instead, one check at a time with its result: a.
plugins:lines show the bundled version with a ✓ for every installed vendor (a mismatch →tlive setup --hooks-only). b. Have the user send the bot a message and confirm the reply arrives (proves the inbound path, not just the config). c. Ask the user to check the bot's command menu shows /mute /trust /safe /mode /help (a stale client cache → close and reopen the chat). d. Desktop notifications: explain one fires per thing that needs you to act — a pending approval, or the idle "waiting for your input" nudge — and tlive never touches it again afterward; it just ages into the notification centre like any other app's, so that's a log, not a live status board (open the dashboard for what's waiting right now). A finished turn notifies the desktop too, after the same grace as the IM card; tool failures stay on IM, since they block nobody. There is no separate on/off switch: use the OS's Do Not Disturb to silence them temporarily, ortlive mode offto stop tlive entirely. e. Hand out the dashboard viatlive url; suggest opening it once. f. Offer optional next steps: add another channel (continue below), or stop here. Then skip to step 8 unless the user wants a new channel. -
If no channel (or adding one): ask whether the user wants Telegram, Feishu, or both, and collect credentials per platform:
- Telegram: bot token (create via @BotFather) + chat id (send the bot a message and read getUpdates, or the user already knows it)
- Feishu: appId + appSecret (self-built app on the open platform with im message permissions)
-
Read
~/.tlive/config.json(may be absent or partial) and MERGE the new fields in (preserve existing ones):{ "allowedSenders": [], "adapters": { "telegram": { "token": "<token>", "chatIdAllowList": ["<chatId>"] }, "feishu": { "appId": "<appId>", "appSecret": "<secret>" } } }(Only write the platforms the user chose; validate the JSON.)
-
tlive stop(if running) thentlive start, thentlive statusto confirm the configured platforms appear under channels. -
Have the user send the bot a test message; hand out the dashboard address via
tlive url. -
Offer remote approval. tlive defaults to
notify(watch + notify only — it never holds a tool call, so a fresh install can't hang a workflow). Ask whether the user wants to Allow/Deny tool calls from their phone; if yes, runtlive mode full(holds each tool call for a remote answer, in parallel with the local prompt — first answer wins; revert any time withtlive mode notify). If they only want monitoring, leave it innotify. If they also want sub-agent approvals on their phone (e.g. they're about to step away), that'stlive mode all— flag the trade: a held sub-agent has no terminal dialog until the window ends, so it only pays off when nobody is at the keyboard (tlive mode fullgoes back). -
If status shows the Codex companion as
offordegraded, explain what it means (codex missing from PATH / nothing answering on the app-server socket — see~/.tlive/codex-appserver.log); Codex approvals stay local-only until it isrunning. There is no trust step to perform, and no restart either: tlive keeps checking, so installing codex clears it on its own.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 69 lines · 13 tokens per session scan C b631ab368d9e
setup is a command published in the GitHub repository y49/tlive (206 stars, last pushed 11d ago), licensed MIT. It adds 13 tokens to every session and 996 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
swift-critique
Critique SwiftUI code for patterns, design, clean code, accessibility, and performance.
test-feature
Generate comprehensive tests for a KMP feature.
review-feature
Review a KMP feature against architecture patterns and spec.
specify
Create or update the feature specification from a natural language feature description.
dead-code-scan
Scan for dead code, unused imports, duplicates, and zombie code across the project.
esp-teach
One-time project setup -- discover hardware, find datasheets, persist context to CLAUDE.md.