thurbox-testing

A testing reference for thurbox, a project with a Lua interface and a Rust kernel, describing its test commands, test areas, and end-to-end test setups.

In plain words
What is it for?
Use it when writing, running, debugging, or extending thurbox tests, including Rust tests, shell-script tests, terminal tests, and session-backend end-to-end tests.
Why use it?
It explains which tests protect the kernel, user interface, installation scripts, extensions, and real terminal behaviour, reducing the chance of using the wrong test method.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/thurbeen/thurbox/thurbox-testing
Any agent
npx skills add Thurbeen/thurbox --skill thurbox-testing
Clone the repo
git clone --depth 1 https://github.com/Thurbeen/thurbox

Made for: Claude Code, Codex.

Per session 111 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,318 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00111 $0.01318
Opus 5 $0.00056 $0.00659
Sonnet 5 $0.00022 $0.00264
Haiku 4.5 $0.00011 $0.00132

Measured 2d ago against content hash 875304fb4757, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

thurbox-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/thurbox-testing/SKILL.md · 85 lines

How it starts

The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Testing thurbox

Working reference extracted from CLAUDE.md, which indexes it. The rationale behind these decisions is owned by the docs under docs/; a change that invalidates what this says updates it in the same PR.

Testing

cargo nextest run --all              # Run all tests (preferred runner)
cargo nextest run -E 'test(name)'    # Run a single test by name
cargo nextest run --all --profile ci # Run with CI profile
bats scripts/install.bats             # Test install script (requires bats-core)
bats extensions/*/scripts/*.bats      # Test the extensions' shell scripts
just test-scripts                     # Both of the above, the way CI runs them

Kernel and interface tests

The interface is Lua on a Rust kernel, so most coverage drives the real kernel over the real ui/ rather than a harness that imitates either:

  • tests/kernel_mvp.rs — the kernel's contract: the four node kinds and their count, the plugin environment enumerated global-by-global (no blanket exemption for a leading underscore — that is how a capability once hid under __run_impl), the instruction/memory bounds, snapshot reads, and painting a plugin to a TestBackend.
  • The per-surface files — one file per surface or contract: session_list, search, new_session, terminal_pane, session_lifetime, keymap, focus, modals, chrome, mouse, hover, decoration, plugin_{authoring,commands,lifecycle,settings,switching}, repo_memory, remote_status, session_status, core_settings, attach_by_name. Several build an interface in a tempdir from the embedded copy, so delivery and loading are exercised together.
  • tests/kernel_limits.rs — instruction and memory ceilings, in their own file because they mutate process-wide limits.
  • Lua staticsselene ui (undefined names + the sandbox, via thurbox.yml), lua-language-server --check (types + withheld libraries), stylua (format). The three cover different halves; see Linting & Formatting.
  • tests/frames.rs — the bundled panes' frames pinned cell for cell, as literals in the file (no snapshot tool): the session list grouped, nested, windowed, narrow and under double-width names; the selection as a style; the agent pane empty, detached, failed, and with a real vt100 screen behind its surface. A failing test prints the new frame as a literal to paste. Every input is pinned (the default preset by name, a fixed elapsed, a fixed snapshot) — keep it that way; a frame that moves on its own is worse than none.
  • tests/render_props.rs — proptest crash invariants: every bundled pane renders and paints at any size down to one cell, the arrangement places its slots inside the screen and apart, no key sequence makes a pane throw (the creation flow included), and selection extraction survives arbitrary buffers and arbitrary vt100 byte streams.
  • tests/tui_e2e.rs (unix) — the real binary on a real pty, via libc's openpty (no PTY crate), fully isolated (private HOME/config/data, a short private TMUX_TMPDIR, network and heartbeat features off). It asserts what no TestBackend test can: the boot frame, the kernel overlays opening and closing, the search strip taking focus, a column toggle reflowing with no screen clear, a resize storm down to 1×1, a broken pane reported through the Interface tab, exit restoring the terminal (alternate screen, mouse, bracketed paste, cursor) — and, where tmux exists, a headlessly created session attached, painted and typed into (sh as the agent). Also just smoke. It replaced the bash tmux smoke script, which could not see the byte stream and duplicated this harness.

Read the full file on GitHub · 85 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 85 lines · 0 tokens per session scan A 875304fb4757

Subscribe to this mod's changes

thurbox-testing is a skill published in the GitHub repository Thurbeen/thurbox (57 stars, last pushed 3d ago), licensed MIT. It adds 111 tokens to every session and 1,318 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

use-agent-browser-for-airi

Test AIRI display-model imports with agent-browser across stage-tamagotchi Electron, stage-web, and stage-pocket mobile web layouts. Use when uploading and verifying contributor-supplied Live2D ZIP, VRM, or MMD ZIP/PMX/PMD files through AIRI's model selector, including onboarding bypass, format-specific import…

moeru-ai/airi · 87 tokens

test-conversion

Workflow for converting unit tests to browser tests for Project Bedrock. Invoke this when the user wants to remove complex Browser dependencies from tests.

chromium/chromium · 31 tokens

agui-dotnet-cross-language-tests

Author cross-language interop tests that verify the AG-UI .NET SDK is wire-compatible with the TypeScript SDK — a Vitest TS client driving a C# CrossLanguage.TestServer over HTTP, both directions, including protobuf byte-parity against @ag-ui/proto. USE FOR: adding or modifying cross-language interop coverage…

ag-ui-protocol/ag-ui · 146 tokens

cli-e2e-testcase-writer

Use when adding or updating Go CLI E2E coverage for one tests/clie2e/{domain} domain of the compiled lark-cli, especially when the work requires live --help or schema exploration, scenario-based clie2e.RunCmd workflows, and per-domain coverage.md maintenance.

larksuite/cli · 78 tokens

harness-test-writer

Add regression test cases to the Bifrost provider harness (the Postman collection run via make run-provider-harness-test) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts…

maximhq/bifrost · 133 tokens

launch

Launch Code OSS (VS Code from sources) into an isolated throwaway profile with unique debug ports so you can drive it with @playwright/cli AND attach a Node debugger via dap-cli in the same session. Use when working on VS Code itself and you want to interact with the running workbench, automate chat or UI flows, test…

microsoft/vscode · 96 tokens