moshi-best-practices

SKILL.md

Moshi Best Practices

Use this skill to make any host feel easy to use from Moshi.

Use it for either:

fresh setup

verification of an existing setup

Rules

Inspect before editing.

Prefer direct config edits over platform-specific setup scripts.

Verify every outcome after changing it.

Do not install the old moshi shell helper or alias. Current installs provide moshi as a symlink to moshi-hook.

1. Host Readiness

For a fresh Moshi SSH/Mosh setup, prefer Easy Pair when moshi-hook is available:
moshi-hook host setup

Tell the user to scan the Easy Pair QR from Moshi. This creates the saved host connection, generates the phone-side private key, and installs Moshi's public key on the host. Call out the security boundary: anyone who scans the QR before it expires can claim SSH access to the host, so they should not share the screen or setup link.

Do not confuse Easy Pair with moshi-hook pair --token; token pairing is only for agent hooks, inbox, Live Activities, and Apple Watch events.

Target outcome:

preferred transport is Mosh plus tmux; fallback is SSH plus tmux

the host has a working SSH entry point

tmux is installed

mosh-server is installed when the user wants Mosh, otherwise SSH plus tmux is acceptable

both resolve in the current shell and in the login shell's non-interactive mode

at least one tmux session exists so the Moshi selector can appear.

Inspect with a small set of real checks. Keep OS-specific mechanics minimal, but do not skip verification.

Useful checks:

command -v tmux || true
command -v mosh-server || true
tmux list-sessions 2>/dev/null || true
LOGIN_SHELL="${SHELL:-/bin/sh}"
"$LOGIN_SHELL" -c 'command -v tmux'
"$LOGIN_SHELL" -c 'command -v mosh-server'

Useful macOS-specific checks when relevant:

dscl . -read "/Users/$USER" UserShell
systemsetup -getremotelogin || true

Verify after changes:

command -v tmux
tmux list-sessions
"$LOGIN_SHELL" -c 'command -v tmux'
"$LOGIN_SHELL" -c 'command -v mosh-server' || true

Then ask the user to reconnect from Moshi. Expected result: the tmux selector appears, and the transport can use Mosh instead of plain SSH when configured.

2. tmux Environment

Use these defaults unless the user wants something different:

set -g history-limit 100000
set -g mouse on
set -g set-titles on
set -g set-titles-string "#I: #W"
set -g base-index 1
setw -g pane-base-index 1
set -g renumber-windows on

Workflow:

inspect the existing tmux config

update overlapping settings instead of appending duplicates

reload tmux after editing

3. MOSHI_CLIENT Signal

MOSHI_CLIENT=1 is an opt-in environment variable the Moshi iOS client exports
into the remote shell so rc files, prompts, and tmux configs can detect a
Moshi-launched session and adapt. The user enables it in the app under
Settings → Integrations → Export ENV (off by default). When on, it is set
identically on both the Mosh path (via mosh-server -l MOSHI_CLIENT=1) and the
SSH fallback (via an injected export at shell start).

The main use case is protecting Moshi's swipe-to-change-window gesture, which
relies on reading the tmux status bar. A populated status-left /
status-right from a custom theme can break detection. Conditionally clearing
them when MOSHI_CLIENT is set keeps local themes intact while keeping Moshi
detection reliable. Other uses: narrower prompts, dropping nerd-font glyphs,
different key bindings.

Shell (in the user's rc file):

if [ -n "$MOSHI_CLIENT" ]; then
  # running under Moshi — trim prompts, skip heavy glyphs, etc.
fi

tmux (in ~/.tmux.conf):

# propagate the variable into tmux sessions attached by this shell
set-option -ga update-environment " MOSHI_CLIENT"

# clear status regions for Moshi clients so swipe detection stays clean
if-shell '[ -n "$MOSHI_CLIENT" ]' {
  set -g status-left ''
  set -g status-right ''
}

After editing, reload tmux (tmux source-file ~/.tmux.conf).

Verify, after the user toggles the setting on and reconnects from Moshi:

echo "$MOSHI_CLIENT"                       # expect: 1
tmux show-environment | grep MOSHI_CLIENT  # expect a value in new sessions

If echo prints nothing, the toggle is off in the app — confirm with the user
before editing host configs. The variable only appears in sessions opened
after the toggle was flipped.

4. tmux Project Session

When moshi-hook is installed from Homebrew or install.sh, prefer the packaged launcher:

moshi .
moshi ~/projects/app

It resolves the directory, names the tmux session from the directory basename, and execs tmux new-session -A -s <name> -c <dir>. No Moshi wrapper process stays alive.

When creating a new session:

read the current working directory

ask one concise question: should the session start from here?

if the answer is no, ask for the directory

default the session name to the directory basename

create the session detached

use the chosen directory for every initial window with tmux ... -c <dir>

Recommended windows:

agent

review

tests

servers

misc

Create the session detached and root every initial window at the chosen directory.

Then ask the user to reconnect in Moshi. Expected result: the session is visible in the tmux selector.

5. Agent Hooks

Moshi has switched to a new hook system: moshi-hook (singular), a portable
Go daemon. Unlike the old fire-and-forget moshi-hooks CLI, the daemon holds a
persistent WebSocket to Moshi, so approvals are bidirectional — users can
approve or deny tool calls directly from the iOS Live Activity or the Apple
Watch, and the answer round-trips back to the agent without leaving the
terminal. It also covers Claude Code, Codex CLI, and OpenCode from a single
install.

Use moshi-hook, not hand-written config, unless the user explicitly wants
manual edits.

Install via the Homebrew tap, then pair and install hooks:

brew tap rjyo/moshi
brew install moshi-hook
moshi-hook pair --token <YOUR_TOKEN>   # token comes from the Moshi mobile app
moshi-hook install                     # writes hook configs for installed agents
brew services start moshi-hook         # keeps the daemon alive across reboots

On macOS, moshi-hook pair uses Keychain by default. If pairing over SSH fails
because Keychain is locked or unavailable, prefer one of these explicit paths:

security unlock-keychain ~/Library/Keychains/login.keychain-db
moshi-hook pair --token <YOUR_TOKEN>

For headless hosts where Keychain access is undesirable or unreliable:

moshi-hook pair --token <YOUR_TOKEN> --store file

--store file writes the host secrets to ~/.config/moshi/secrets.json with
0600 permissions and remembers the store choice for future serve, status,
usage --sync, and pair commands. Do not use it silently; call out that this
stores secrets outside Keychain.

moshi-hook install is non-destructive — it writes Moshi entries into
~/.claude/settings.json, ~/.codex/config.toml, and
.opencode/plugins/moshi-hooks.ts, leaving any user-owned hooks alone.

Verify:

moshi-hook status         # pairing state, socket path, WS connection
moshi-hook logs -f        # tail the daemon log

Then run a short real agent task and confirm Moshi receives a push
notification or Live Activity update, and that approving from the Live
Activity / Watch unblocks the agent.

For full CLI reference (every subcommand, flag, env var, and path), see
app-hook/docs/usage.md in the monorepo, or the mirrored copy in the
rjyo/homebrew-moshi tap.

Legacy: moshi-hooks (Bun CLI)

The previous Bun-based CLI still works for older agent versions and for
environments where Homebrew is unavailable. It is fire-and-forget — no
bidirectional approvals, no Live Activity / Watch round-trip — but it remains
a valid fallback. Do not mix the two on the same host: if moshi-hook is
installed and paired, prefer it.

bunx moshi-hooks setup
bunx moshi-hooks token <YOUR_TOKEN>

Optional integrations:

bunx moshi-hooks setup --local
bunx moshi-hooks setup .
bunx moshi-hooks setup --codex
bunx moshi-hooks setup --opencode