Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mindverse-ltd/macaron-artifacts/macaron-webuinpx skills add mindverse-ltd/macaron-artifacts --skill macaron-webuigit clone --depth 1 https://github.com/mindverse-ltd/macaron-artifactsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mindverse-ltd/macaron-artifacts/macaron-webui)<a href="https://agentmods.dev/skills/mindverse-ltd/macaron-artifacts/macaron-webui"><img src="https://agentmods.dev/badge/skills/mindverse-ltd/macaron-artifacts/macaron-webui.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00207 | $0.01339 |
| Opus 5 | $0.00103 | $0.00669 |
| Sonnet 5 | $0.00041 | $0.00268 |
| Haiku 4.5 | $0.00021 | $0.00134 |
Grade A, and why
macaron-webui scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- macaron-webui-kimi — 88% identical, 37 lines differ
How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Macaron WebUI
Use this skill when the user wants to open the Macaron WebUI — a local browser app that lists Codex workspaces + sessions from ~/.codex/sessions/, lets them continue any turn, and streams GenUI TSX previews.
"macaron web ui" is a proper noun, not a task. Phrases like "open macaron web ui" / "打开 macaron web ui" / "launch the macaron ui" always mean launch this WebUI. They do NOT mean "deploy the current project", "build the repo I'm in", or "start a dev server for the surrounding codebase" — regardless of what project the user currently has open. If you're tempted to deploy or serve the current directory in response to one of these phrases, that's the misread this skill exists to prevent: run the bootstrap below instead.
Resolving the plugin root
Resolve the plugin root from this SKILL.md file by going two directories up from codex-skills/macaron-webui/. The launcher script is at <plugin root>/start.sh.
Bootstrap
Run this exactly once. Two env vars matter:
MACARON_ENGINE=codex— flips the SPA served at/from the Claude-focused UI to the Codex-focused one. Never omit this. Without it the user sees the Claude Code UI, not Codex.MACARON_FOREGROUND=1— makesstart.shexec nodeinto the foreground instead of nohup-backgrounding. Backgrounded children get killed when the outer script returns inside your Bash tool, so the server would disappear seconds after launch. Foreground keeps the process anchored to the tool session and the URL is printed asynchronously beforeexecblocks.
MACARON_ENGINE=codex MACARON_FOREGROUND=1 MACARON_PORT=7979 bash "<plugin root>/start.sh"
Port 7979 is the Codex-side default so it doesn't collide with the Claude Code plugin (which uses 7878). Both can run at once. If 7979 is busy, tell the user to override with MACARON_PORT=<n>.
The script:
- Mirrors itself out of the plugin cache on first launch.
~/.codex/plugins/cache/…is not a stable working directory — Codex prunes it on version sync, which erasesnode_modules+web/dist+server/distwhile any surviving server still listens on 7979 and returns 404s.start.shdetects the cache path and rsyncs source into~/.macaron/runtime/<version>/, then installs/builds/runs from there. Subsequent launches re-rsync (fast) and reuse the same stable runtime. - Uses
corepack pnpm(Node 22+ ships corepack) to install workspace deps + build on first launch (~60s). If frozen install fails, it retries without the lock. If build fails, it prints a[macaron] fix: <command>line — run the printed command and retry. - Skips the install/build on subsequent launches if
node_modulesis present and no source file is newer than the current build. - Frees the port if a stale
mcx/mccis bound (lsof→kill). - Prints
Macaron WebUI (engine=codex): http://localhost:7979once/api/healthanswers, THEN blocks onexec node. - Stays in the foreground indefinitely. This is expected — do NOT kill it after launch. The Bash tool can move on while this shell keeps the server alive.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 59 lines · 207 tokens per session scan A 6da3d515d017
macaron-webui is a skill published in the GitHub repository mindverse-ltd/macaron-artifacts (10 stars, last pushed 11d ago), licensed Apache-2.0. It adds 207 tokens to every session and 1,339 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
archscribe
Create premium hand-drawn architecture, workflow, and swimlane diagrams in a dark neon or light paper style, with editable Excalidraw sources, PNG/SVG previews, animated GIF/MP4 output, and interactive HTML. Use whenever the user asks for 岚叔动态架构图、手绘架构图、Excalidraw 风格图、DailyDoseOfDS 风格技术图、动态流程图、泳道图、系统可视化，或希望复刻并提升参考架构图。.
artifact-styler
Restyle an artifact (an Artifact Organizer HTML/JSON output, or any content you can express as a component envelope) into a chosen visual theme — notion, linear, vercel, stripe, supabase, apple, or tailwind. Use when the user says "restyle this", "make it look like apple/tailwind/stripe", "apply the X theme", "change…
design-standards
Data visualization design standards and 100-point scoring rubric for dashboards — visual hierarchy, color discipline, spacing, chart hygiene. Derived from Tableau Viz of the Day winners. Use when designing a dashboard layout or lint-scoring a rendered dashboard screenshot.
Explainer
Generate dense, visual-first HTML explainers in a signature dark aesthetic — diagrams carry the design, prose is captions only. Every section has a custom inline-SVG visualization: pipeline DAGs, archetype grids, hub-and-spoke diagrams, decision trees, risk matrices, gantt timelines, layer cakes, palette swatches…
html-artifact-guide
Use when creating, reviewing, or improving standalone single-file HTML artifacts for comparison matrices, dashboards, timelines, review surfaces, visual explainers, research synthesis, or interactive checklists. Do not use for simple documentation, meeting notes, knowledge base articles, or content where Markdown…
json-render-catalog
Skill "json-render-catalog" from yonatangross/orchestkit, covering json-render component catalogs, storybook → catalog import (#1529, 2026-04), new in 2026-04 → 2026-08 (json-render 0.14 → 0.20), directives — @json-render/directives (0.19) and registration.