T3 Tots

Grok Bot / chat companion for T3 Code, with skills and helper tools. Thread status, waiting items, new threads, answers, reports, watches, and updates.

T3 Tots is unofficial. t3ctl and t3listen use T3 Code’s internal local websocket API, which isn’t public or stable, and t3q.py reads its database read-only. A T3 Code update can break them. T3 Code now has an official MCP server for outside agents and a t3 thread command. They don’t cover everything T3 Tots does yet, such as permission approvals, live events to a webhook, resuming a stuck queue and usage-limit recovery. T3 Tots moves features onto the official interfaces as they gain coverage.

MIT. No accounts or telemetry. The only outbound send is optional t3listen to a webhook you set up.

Start with t3-getting-started. Install and verify by following AGENTS.md. Shared rules: t3-tots-rules.

What’s here

Install

Install from a release tag, not from main. Every file is checked against that tag’s manifest.json before it is used.

Grok Bot. Skills are built in. Say “set up T3 Tots”. After your yes it installs the tools on each computer. The template card starts as a geometric mark. On first setup the official face from assets/avatar.png is set at the opening, before install, when that download works.

Other agents (Claude Code, Codex, Cursor, Hermes). Download a release or clone the tag, then install the skills:

gh release download -R Deepusleepy/t3-tots --archive tar.gz
tar xzf t3-tots-*.tar.gz && cd t3-tots-*/
node tools/t3ctl skills install --to ~/.claude/skills --dry-run
node tools/t3ctl skills install --to ~/.claude/skills

Clone the same tag:

git clone --branch  --depth 1 https://github.com/Deepusleepy/t3-tots.git
cd t3-tots
node tools/t3ctl skills install --to ~/.claude/skills --dry-run
node tools/t3ctl skills install --to ~/.claude/skills

Windows: gh release download -R Deepusleepy/t3-tots --archive zip, expand, then --to "$env:USERPROFILE\.claude\skills".

Skill folders: Claude Code ~/.claude/skills, Codex ~/.agents/skills, Cursor ~/.cursor/skills, Hermes ~/.hermes/skills (same paths under %USERPROFILE% on Windows). Install into one folder only. Cursor also loads the other three, so a second copy is listed twice.

Then ask the agent to set up T3 Tots. It follows AGENTS.md (hash-check against manifest.json. Grok Bot-only steps: t3-tots-rules “Grok Bot only”). Updates use the same commands. Edited skills are kept unless you pass --force (the old copy goes to out/skills-backup//).

Phone answers (optional)

t3listen POSTs live T3 events to a webhook you set up (setup, then install at login). Events: request.opened / request.resolved, and thread.finished / failed / cancelled. Approvals only if you turn them on. Usage-limit stops can arm T3’s Resume at reset.

Setup, events, approvals, and autoresume: t3-phone-answers. Who may answer: t3-tots-rules “Decisions”.

Delegated mode and approvals

Delegated mode starts only when you hand over control, for example “I’m away, keep it moving”. The agent then answers routine questions, nudges stalled threads, and resumes threads after a usage limit.

Even a full-access thread can stop on “Allow running this command?” when a safety check flags it, for example a git hook that asks before git reset --hard. In delegated mode the agent never says yes to these. It declines them with t3ctl answer --decision decline --redirect, which tells the thread not to retry or work around it, to use a safer way or skip that step, and to keep going. You get the list of what was declined and why when you’re back.

When you’re around, each approval comes to you as a card with the reason it asks, and the agent accepts it only after your yes for that request. t3ctl answer backs this up. An accept without --user-approved is refused with NEEDS_USER_APPROVAL, and nothing is sent.

Threads that t3ctl new and t3ctl tasks --upsert start run in full access unless you pass --runtime.

Requirements

• Python 3.8+ for t3q.py and cleanup/scan.py (3.9+ for report/report.py). Windows: py -3.
• Node 22+ for t3ctl and t3listen (Node 18+ for export.js and survey.js).
• T3 Code installed and opened at least once.

Security

• t3q.py opens statev2.sqlite read-only. From server-runtime.json it reads only host, port and pid.
• Scripts never open T3’s secrets/ or other credentials. The only token they read sits next to them, after your yes, with a 90-day TTL, and is never printed. Issue and revoke: t3-tots-rules “Token”.
• Traffic stays on 127.0.0.1 except optional t3listen POSTs to your webhook. Exports redact API-key patterns and your home path.
• No token: read-only. With one, t3ctl answer sends only the answer you chose, and accepts an approval only with --user-approved. t3ctl skills writes only into --to and its own out/.

Report issues in SECURITY.md.

Developing

• scripts/check.sh. Syntax, tests, manifest freshness, CRLF on the Windows wrappers, private-word scan. Never-ship words go one per line in ~/.config/t3-tots/private-words.txt (do not commit it). No list fails the check. T3TOTS_NO_PRIVATE_WORDS=1 skips it on purpose.
• After changing a tool, add it to TOOLS in scripts/make-manifest.py and run that script. It rewrites manifest.json from VERSION.
• scripts/sync-skills --from (or T3TOTS_SKILLS_SRC) copies live skills into skills/, scans for private details, and updates the manifest. It copies nothing if the scan fails.
• Never decide an approval by reading its text. T3 often shows a description instead of the command. Approval decisions go through approvalAuthority.
• Release only from a tag. Installers download by tag and check every hash.