Borrowing it
Nothing to install: this file belongs to vmehera123/leashd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vmehera123/leashd/main/.claude/skills/tmux-runtime/SKILL.mdgit clone --depth 1 https://github.com/vmehera123/leashdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vmehera123/leashd/tmux-runtime)<a href="https://agentmods.dev/skills/vmehera123/leashd/tmux-runtime"><img src="https://agentmods.dev/badge/skills/vmehera123/leashd/tmux-runtime.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.01352 |
| Opus 5 | $0.00058 | $0.00676 |
| Sonnet 5 | $0.00023 | $0.00270 |
| Haiku 4.5 | $0.00012 | $0.00135 |
Grade B, and why
tmux-runtime scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
leashd writes a **managed `--settings`** file and never touches the user's `~/.claude/settings.json`. The opt-in `security-guidance` marketplace plugin (`LEASHD_SECURITY_GUIDANCE_ENABLED`; install ≠ enable) composes its How it starts
The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.
tmux runtime
leashd's default runtime. Instead of leashd owning a subprocess, it runs a real interactive claude TUI inside a tmux pane on a private socket, and the safety pipeline runs over Claude Code HTTP hooks (the --permission-prompt-tool path does not fire in interactive mode). Requires claude ≥ 2.1.141 and tmux ≥ 3.3. Default socket: ~/.leashd/tmux/tmux.sock (LEASHD_TMUX_SOCKET_DIR).
Files
| File | Role |
|---|---|
agents/runtimes/tmux.py |
TmuxAgent — the BaseAgent impl; spawns/follows panes, cancel_chat() to kill a live pane by chat |
agents/runtimes/tmux_session.py |
TmuxSessionManager — owns all tmux/libtmux interaction and the hook→gatekeeper bridge (~3k lines; the heavy core) |
web/tmux_hooks.py |
thin FastAPI router; Claude Code hooks POST here, it delegates to the session manager |
web/tmux_jsonl.py |
polls the session JSONL and feeds text/cost events back (streaming) |
web/tmux_server.py |
standalone loopback hook receiver for Telegram-only / CLI-only mode (WebUI/multi mode mounts the hook router on the WebUI app instead) |
main.py:_maybe_tmux_session_manager builds the shared TmuxSessionManager singleton so the hook receiver and the runtime drive the same manager.
How a turn works
- Prompt in — text is injected as keystrokes into the pane's composer. The TUI ignores programmatic answer payloads (
updatedInput.answers), so questions/approvals must be answered by driving keystrokes, not by returning data. - Per tool call — a synchronous
PreToolUsehook POSTs to leashd →TmuxSessionManager→ToolGatekeeper(sandbox → policy → approval). The hook's allow/deny response gates the call, and the human/AI wait happens inside this hook. Its timeout is set effectively-infinite (1 year — Claude Code has no infinite hook value and no heartbeat; a daemon restart reaps panes). - Async hooks —
UserPromptSubmit,PostToolUse,Stop,SubagentStop,SessionStart,SessionEnd,Notificationare fire-and-forget and drive streaming + turn-completion. - Streaming + cost — tailed from
~/.claude/projects/<encoded-cwd>/<session-uuid>.jsonl(seeencode_project_dir). Turn end is authoritative on theStophook OR the JSONLresultline — both fire for one response, so they're de-duped per turn.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 59 lines · 116 tokens per session scan B 6b0e4b5d8027
tmux-runtime is a skill published in the GitHub repository vmehera123/leashd (5 stars, last pushed 12d ago), licensed Apache-2.0. It adds 116 tokens to every session and 1,352 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
harness-doctor
Check whether this project's Agentsmith harness is installed correctly and healthy — fires on "is my harness set up right?", "harness doctor", "check my harness". Part of the Agentsmith harness; checks each selected agent's managed rules, settings, skills, hooks, verification, and leanness with a one-line fix for each…
nio-scan
Nio code/skill execution-risk scanner. Use when the user wants to scan a file, repo, directory, or skill for execution risks — e.g. "scan this code for risks", "is this file/plugin dangerous", "check this repo for malicious code", "run nio scan on ". Focused single-purpose skill; for other Nio operations use /nio.
nio-doctor
Nio config validator + connectivity check. Use when the user wants to validate their Nio setup — e.g. "run nio doctor", "is my nio config valid / working", "test my OAuth / external endpoint / LLM connectivity", "why isn't my scorer firing". Focused single-purpose skill; for other Nio operations use /nio.
discover
Spawn parallel specialist agents to scan the codebase and produce a prioritized improvement backlog.
lead-bug-hunt
Autonomous bug-elimination loop. Iteratively invokes /bug-hunt and /implement-batch until findings converge below an operator-specified severity floor. At termination, runs /review-test scoped to the run's new reproducing tests and fixes quality issues above the floor. Auto-approves /bug-hunt and /review-test ticket…
bug-hunt
Proactive bug-hunting workflow. Assesses codebase risk through complexity, coverage, and structural analysis, then spawns focused investigators that write reproducing tests to validate suspected bugs. Thoroughness over speed. Advisory only — produces findings and proposes tickets; does not implement fixes.