Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thurbeen/thurbox/thurbox-clinpx skills add Thurbeen/thurbox --skill thurbox-cligit clone --depth 1 https://github.com/Thurbeen/thurboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00104 | $0.06248 |
| Opus 5 | $0.00052 | $0.03124 |
| Sonnet 5 | $0.00021 | $0.01250 |
| Haiku 4.5 | $0.00010 | $0.00625 |
Grade A, and why
thurbox-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 380 lines — stays where its author put it; the contents beside it link to each section on GitHub.
thurbox-cli, automations, tasks and messages
Working reference extracted from CLAUDE.md, which indexes it. The rationale behind these decisions is owned by the docs under docs/; a change that invalidates what this says updates it in the same PR.
thurbox-cli
A second binary (thurbox-cli) drives the same SQLite-backed,
tmux-hosted sessions headlessly (no TUI). It shares the database
with the TUI; changes appear via PRAGMA data_version polling.
cargo build --bin thurbox-cli
thurbox-cli session create --name demo --repo-path /path \
--agent codex --worktree-branch feat/x
# Spawn on a remote host from hosts.toml (worktree + tmux live remotely):
thurbox-cli session create --name demo --repo-path /srv/repo \
--host devbox --worktree-branch feat/x
# Spawn a worker under a lead session (parent must exist):
thurbox-cli session create --name worker --repo-path /path \
--parent <lead-uuid>
# Multi-repo: each --add-repo gets its own worktree on --worktree-branch;
# --add-dir attaches a repo as-is (no branch). The agent launches in a
# symlink workspace gathering every repo. Works on `task create` too.
thurbox-cli session create --name demo --repo-path /a \
--agent claude --worktree-branch feat/x \
--add-repo /b@main --add-repo /c@master --add-dir /reference
thurbox-cli session list # human-readable table
thurbox-cli session list --json | jq # machine output for scripts
thurbox-cli session list --parent <lead-uuid> --json | jq # direct children only
Subcommands: session (create/list [--deleted]/get/delete/restore/restart
[--if-missing]/send [--no-enter]/key/capture/focus/signal/doctor/sync/register —
sync/register and the flags serve session sharing, ADR-24), automation (alias auto:
create/list/show/edit/remove/run/runs/tick), task (alias todo:
create/list/show/edit/remove/run), message (alias msg:
send/inbox/prune — the inter-session mailbox queue; see below), editor
(get/set the Ctrl+O editor command; editor mode <auto|terminal|gui> chooses
how it launches — terminal editors get a real TTY via a tmux popup or TUI
suspend, GUI editors spawn detached; see the Editor Integration section of
docs/FEATURES.md), config
(validate/show — strict-parses every config file / prints the
effective resolved config; see docs/CONFIG.md), extension
(alias ext: install/uninstall/reinstall/list/available/update/activate/
deactivate/status — manage opt-in extensions; see below), version
(prints the running version; --check queries GitHub's latest release —
gated on [features] version_check, on by default for 1.0), update
(downloads, verifies, and replaces the installed binaries with the latest
release within the current major — a new major is reported, never installed,
because 2.x replaced the whole interface; --force bypasses the
up-to-date/dev-build/major guards; gated on
[features] auto_update, on by default for 1.0; the TUI also runs this silently on
startup when the flag is on), notify
(diagnose OS desktop notifications: prints the detected delivery backend
and last error; --test fires a sample — see OS notifications below), perf
(print the perf snapshot a running TUI publishes while THURBOX_PERF_LOG
or its perf HUD is active — see docs/PERFORMANCE.md), plugin
(v2 interface plugins without a TTY: dir reports the directory in force and
which of the two rules chose it, new <name> writes a starter that already
loads, check loads the interface the way thurbox does and exits non-zero on
a failure — including on a pane that loaded but which no arrangement places,
printing the layout.lua line to add — list is the same inventory the settings
modal's Interface tab shows, and
events lists every event a plugin may subscribe to with its payload, and
install|sync|update|remove|available manage panes from a declarative spec
— see docs/PLUGINS.md).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 380 lines · 0 tokens per session scan A 43d35ba69e4e
thurbox-cli is a skill published in the GitHub repository Thurbeen/thurbox (57 stars, last pushed 2d ago), licensed MIT. It adds 104 tokens to every session and 6,248 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…