@gloom-sh/terminal 0.19.2 → 0.19.3

package/src/cli/pane-functions/resolver.ts

@@ -11,7 +11,7 @@ import { applyChartComposerCapabilityOptions } from "../../plugins/builtin/chart
 import { parseChartSpec } from "../../plugins/builtin/chart-composer/chart-spec";
 import { normalizeTickerInput } from "../../tickers/search";
 import { slugifyName } from "../../utils/slugify";
-import { ListingArgError, listingInstrument, listingReadNotes, resolveCliListing, usListingsOnlyMessage } from "../listing-arg";
+import { listCoinNotes, ListingArgError, listingInstrument, listingReadNotes, resolveCliListing, usListingsOnlyMessage } from "../listing-arg";
 import { uncoveredInstrumentKind, uncoveredInstrumentMessage } from "../../tickers/instrument-coverage";
 import { uncoveredInstrumentCommand } from "../uncovered-instrument";
 import { listingAbroadVenue } from "../../utils/sec";
@@ -83,7 +83,7 @@ async function buildPaneInstance(
   // Free text is a phrase, not a symbol. Treating it as a ticker makes the
   // pane look for a provider for values such as "HIGH GROWTH SOFTWARE".
   const headlessArgKind = resolved.headless?.argument.kind;
-  const fallbackSymbol = !argumentNamesTicker(resolved.template, resolved.headless)
+  const fallbackSymbol = !argumentNamesTicker(resolved.template, resolved.headless, resolved.pane)
     ? null
     : headlessArgKind === "tickers" || headlessArgKind === "symbol-list"
       ? normalizeTickerInput(null, cleanTickerInput(target.split(/[,\s]+/)[0] ?? ""))
@@ -254,8 +254,9 @@ export async function applyListingArgument(
     }
     notes.push(...answers.map((answer) => `${answer.message} ${answer.details.replaceAll("\n", " ")}`));
   }
-  // One listing's notes come with its choice note; a list's are said here.
-  if (listings.length > 1) notes.unshift(...listings.flatMap(listingReadNotes));
+  // One listing's notes come with its choice note; a list's are said here, with a coin's code read as a listing
+  // (CORR RIOT,BTC: BTC is the Grayscale fund) as `quote BTC` says it.
+  if (listings.length > 1) notes.unshift(...listings.flatMap(listingReadNotes), ...await listCoinNotes(listings, context));
   return {
     ...args,
     arg: listings.map((listing) => listing.key).join(", "),
@@ -349,8 +350,8 @@ export async function resolvePaneFunction(
   if (!pane) {
     throw new Error(`Template "${template?.id}" points at missing pane "${template?.paneId}".`);
   }
-  const createOptions = buildCreateOptions(template, args.arg);
   const headless = getHeadlessPaneDefinition(template, pane);
+  const createOptions = withTickerList(template, buildCreateOptions(template, args.arg), headless, args.arg, paneFunctionCode(template, pane));
   const capability = getPaneFunctionCapability(template, pane);
   let tableSection: string | true | undefined;
   if (resolutionSettings.tableSection) {
@@ -400,6 +401,27 @@ export async function resolvePaneFunction(
   return resolved;
 }
 
+/**
+ * A one-ticker template whose pane also opens on a list (`opensTickerList`:
+ * DVD's ranking): the list is passed as `symbols`, so `shot` draws the same
+ * tickers `fn` reads, in one pane, and fetches each; past the most the
+ * function's report takes, it is refused as `fn` refuses it. One ticker, and
+ * any other template, stays as it was.
+ */
+export function withTickerList(
+  template: PaneTemplateDef | undefined,
+  createOptions: PaneTemplateCreateOptions | undefined,
+  headless: HeadlessPaneDefinition | undefined,
+  arg: string,
+  token = template?.shortcut?.prefix ?? "",
+): PaneTemplateCreateOptions | undefined {
+  if (!template?.opensTickerList || !createOptions || createOptions.symbols?.length) return createOptions;
+  const symbols = [...new Set(arg.split(/[,\s]+/).map((word) => cleanTickerInput(word)).filter(Boolean))];
+  if (symbols.length < 2) return createOptions;
+  if (headless) validateSymbolCount(headless, token, symbols, "shot");
+  return { ...createOptions, symbol: symbols[0]!, arg: symbols.join(","), symbols };
+}
+
 function validateTickerCardinality(
   capability: PaneFunctionCapability,
   createOptions: PaneTemplateCreateOptions | undefined,

package/src/cli/pane-functions/screenshot-assessment.ts

@@ -208,6 +208,39 @@ export function filledKeyValueCount(rows: DesktopPaneShotRenderResult["visibleKe
   }).length;
 }
 
+/**
+ * Whether a capture shows nothing that was loaded: a wall that needs an
+ * account, or an empty, loading or failed state, with no rows, labeled values
+ * or plotted chart beside it. Its footer carries no status line then, as it
+ * has no data to date: the quotes the capture loaded for its symbol are not on
+ * screen. A pane that only locks or fails part of what it shows keeps it.
+ */
+export function shotLoadedNothing(
+  render: Pick<DesktopPaneShotRenderResult, "accessGate" | "emptyStateDetected" | "loadingStateDetected" | "errorStateDetected" | "rows" | "visibleKeyValues" | "semanticUi">,
+): boolean {
+  const stated = !!render.accessGate || render.emptyStateDetected || render.loadingStateDetected || render.errorStateDetected;
+  return stated
+    && render.rows.length === 0
+    && filledKeyValueCount(render.visibleKeyValues) === 0
+    && !render.semanticUi.some(plotsData);
+}
+
+/**
+ * A pane's chart evidence node that says it plotted something: a count of
+ * plotted values, or series with points. A node that is neither (a shape this
+ * does not know) counts as plotted, so its pane keeps its line.
+ */
+function plotsData(node: RemoteUiNodeSnapshot): boolean {
+  if (node.role !== "chart-data") return false;
+  const metadata = node.metadata;
+  if (!isRecord(metadata)) return true;
+  const counts = [metadata.plottedValueCount, metadata.projectedPointCount].filter((count): count is number => typeof count === "number");
+  if (counts.length > 0) return counts.some((count) => count > 0);
+  const lists = [metadata.series, metadata.baseSeries, metadata.resolvedSeries].filter(Array.isArray);
+  if (lists.length === 0) return true;
+  return lists.some((list) => list.some((series) => isRecord(series) && typeof series.pointCount === "number" && series.pointCount > 0));
+}
+
 /**
  * A 3D surface that is not the real drawing: the frame has no mesh, or the 2D
  * grid stands in for it. Both are fine for a person using the pane and wrong

package/src/cli/pane-functions/screenshot-bridge.ts

@@ -1,14 +1,20 @@
+import { lookup } from "dns/promises";
+import { isIP } from "net";
 import { fetchTape } from "../../plugins/builtin/time-sales/client";
 import {
+  encodeResponseBody,
   readRequestInit,
-  toResponseEnvelope,
+  toResponseHead,
   type HttpProxyRequestEnvelope,
   type HttpProxyResponseEnvelope,
 } from "../../utils/http-proxy-response";
+import { fetchCheckingRedirects, readBytesWithin } from "../../utils/http-proxy-upstream";
+import { isPublicAddress } from "../../utils/public-address";
 import type { DesktopPaneShotApiProxy, DesktopPaneShotBridge } from "../desktop-pane-shot";
 import type { MarketContext } from "../types";
 import { resolvePersistedCloudSessionToken } from "./cloud-session";
 import { getCloudApiBaseUrl } from "../../api-client/request";
+import { fetchShotHttpAddress } from "./screenshot-http";
 
 const CREDENTIAL_FIELD_NAMES = new Set([
   "accesstoken",
@@ -98,10 +104,27 @@ const SHOT_BRIDGE_MARKET_OPERATIONS = new Set([
 ]);
 
 const SHOT_BRIDGE_HTTP_TIMEOUT_MS = 20_000;
+/** Feeds and API answers are far smaller; the answer goes to the page whole, as JSON. */
+const SHOT_BRIDGE_HTTP_MAX_BYTES = 25 * 1024 * 1024;
+/** What panes send through `httpFetch` while they draw: reads, and the POST a few APIs take a query as. */
+const SHOT_BRIDGE_HTTP_METHODS = new Set(["GET", "HEAD", "POST"]);
+
+/** The addresses a host name resolves to. */
+type ResolveHost = (hostname: string) => Promise<string[]>;
+
+const resolveHost: ResolveHost = async (hostname) => (
+  await lookup(hostname, { all: true, verbatim: true })
+).map((entry) => entry.address);
+
+interface ShotHttpOptions {
+  resolveHost?: ResolveHost;
+  fetch?: typeof fetch;
+}
 
 export function createDesktopShotBridge(
   context: Pick<MarketContext, "dataProvider">,
   tapeBootstrap: typeof fetchTape = fetchTape,
+  httpOptions: ShotHttpOptions = {},
 ): DesktopPaneShotBridge {
   return {
     async marketData(operation, args) {
@@ -123,30 +146,88 @@ export function createDesktopShotBridge(
         args,
       );
     },
-    httpFetch: (request) => runDesktopShotHttpFetch(request),
+    httpFetch: (request) => runDesktopShotHttpFetch(request, httpOptions),
   };
 }
 
+/**
+ * Whether the page may reach `raw`: http or https on a host whose every
+ * address is on the public internet. Panes read public APIs and news feeds;
+ * nothing they draw lives on this machine or its network, and a URL that
+ * names one (or a host that resolves to one) is refused.
+ */
+async function checkShotHttpTarget(
+  raw: string,
+  resolve: ResolveHost,
+): Promise<{ url: URL; address: string } | { error: string; status: number }> {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    // Intentional ignore: a URL that does not parse is answered as an invalid target, never fetched.
+    return { error: "The target URL is not valid.", status: 400 };
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return { error: `Screenshot HTTP bridge refuses ${url.protocol} requests.`, status: 400 };
+  }
+  if (url.username || url.password) return { error: "Credentials in the URL are not allowed.", status: 400 };
+  const host = url.hostname.replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
+  const refused = { error: `Screenshot HTTP bridge refuses ${url.hostname}: it is not on the public internet.`, status: 403 };
+  if (host === "localhost" || host.endsWith(".localhost")) return refused;
+  let addresses: string[];
+  try {
+    addresses = isIP(host) ? [host] : await resolve(host);
+  } catch {
+    return { error: `Could not resolve ${url.hostname}.`, status: 502 };
+  }
+  if (addresses.length === 0) return { error: `Could not resolve ${url.hostname}.`, status: 502 };
+  if (!addresses.every(isPublicAddress)) return refused;
+  const address = addresses.find((candidate) => isIP(candidate) === 4) ?? addresses[0]!;
+  return { url, address };
+}
+
 /**
  * Panes such as DVD fetch a third-party API directly. A browser cannot: the
  * request is cross-origin and dies in CORS, so the pane reported that the
  * ticker pays no dividend. The desktop renderer already proxies these through
- * its native half; the screenshot page gets the same treatment.
+ * its native half; the screenshot page gets the same treatment, limited to
+ * public hosts, each redirect checked like the first URL.
  */
 async function runDesktopShotHttpFetch(
   request: HttpProxyRequestEnvelope,
+  options: ShotHttpOptions,
 ): Promise<HttpProxyResponseEnvelope> {
-  const target = new URL(request.url);
-  if (target.protocol !== "http:" && target.protocol !== "https:") {
-    throw new Error(`Screenshot HTTP bridge refuses ${target.protocol} requests.`);
+  const resolve = options.resolveHost ?? resolveHost;
+  const addresses = new Map<string, string>();
+  const checkTarget = async (raw: string) => {
+    const checked = await checkShotHttpTarget(raw, resolve);
+    if ("url" in checked) addresses.set(checked.url.href, checked.address);
+    return checked;
+  };
+  const target = await checkTarget(typeof request?.url === "string" ? request.url : "");
+  if ("error" in target) throw new Error(target.error);
+  const init = readRequestInit(request.init);
+  if (!SHOT_BRIDGE_HTTP_METHODS.has(init.method)) {
+    throw new Error(`Screenshot HTTP bridge refuses ${init.method} requests.`);
   }
-  const { method, headers, body, redirect } = readRequestInit(request.init);
-  const response = await fetch(target, {
-    method,
-    headers,
-    body,
-    redirect,
+  const result = await fetchCheckingRedirects(target.url, init, {
+    fetch: options.fetch ?? (async (input, init) => {
+      const url = new URL(String(input));
+      const address = addresses.get(url.href);
+      if (!address) throw new Error("The screenshot target has not been checked.");
+      return fetchShotHttpAddress(url, init ?? {}, address);
+    }) as typeof fetch,
+    check: checkTarget,
     signal: AbortSignal.timeout(SHOT_BRIDGE_HTTP_TIMEOUT_MS),
   });
-  return toResponseEnvelope(response);
+  if ("error" in result) throw new Error(result.error);
+  const { response } = result;
+  const tooLarge = `The response from ${target.url.hostname} is larger than ${SHOT_BRIDGE_HTTP_MAX_BYTES / (1024 * 1024)} MB.`;
+  if (init.method !== "HEAD" && Number(response.headers.get("content-length") ?? 0) > SHOT_BRIDGE_HTTP_MAX_BYTES) {
+    await response.body?.cancel().catch(() => { /* Intentional ignore: an answer over the cap is dropped unread. */ });
+    throw new Error(tooLarge);
+  }
+  const body = await readBytesWithin(response.body, SHOT_BRIDGE_HTTP_MAX_BYTES);
+  if (body === null) throw new Error(tooLarge);
+  return { ...toResponseHead(response), ...encodeResponseBody(body) };
 }

package/src/cli/pane-functions/screenshot-http.ts

@@ -0,0 +1,70 @@
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { Readable } from "node:stream";
+import { checkServerIdentity } from "node:tls";
+import { createBrotliDecompress, createGunzip, createInflate } from "node:zlib";
+
+/**
+ * A single HTTP hop to an address already checked by the screenshot bridge.
+ * The socket uses that address directly, while Host and TLS keep the URL's
+ * name. A fresh connection keeps another request's DNS result out of the hop.
+ */
+export function fetchShotHttpAddress(url: URL, init: RequestInit, address: string): Promise<Response> {
+  if (!isIP(address)) return Promise.reject(new Error("The screenshot address must be an IP address."));
+  const headers = new Headers(init.headers);
+  headers.set("host", url.host);
+  headers.set("accept-encoding", "gzip, deflate, br");
+  if (!headers.has("accept")) headers.set("accept", "*/*");
+  if (!headers.has("user-agent")) headers.set("user-agent", `Bun/${Bun.version}`);
+  if (typeof init.body === "string" && !headers.has("content-type")) headers.set("content-type", "text/plain;charset=UTF-8");
+  const requestHeaders: Record<string, string> = {};
+  headers.forEach((value, name) => { requestHeaders[name] = value; });
+  const hostname = url.hostname.replace(/^\[|\]$/g, "");
+  return new Promise((resolve, reject) => {
+    const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
+      hostname: address,
+      method: init.method,
+      headers: requestHeaders,
+      agent: false,
+      signal: init.signal ?? undefined,
+      ...(url.protocol === "https:" ? {
+        servername: isIP(hostname) ? "" : hostname,
+        checkServerIdentity: (_name: string, certificate: Parameters<typeof checkServerIdentity>[1]) => checkServerIdentity(hostname, certificate),
+      } : {}),
+    }, (incoming) => {
+      try {
+        const responseHeaders = new Headers();
+        for (let index = 0; index < incoming.rawHeaders.length; index += 2) {
+          responseHeaders.append(incoming.rawHeaders[index]!, incoming.rawHeaders[index + 1]!);
+        }
+        const status = incoming.statusCode ?? 502;
+        if (init.method === "HEAD" || status === 204 || status === 205 || status === 304) {
+          incoming.resume();
+          resolve(new Response(null, { status, statusText: incoming.statusMessage, headers: responseHeaders }));
+          return;
+        }
+        const encoding = responseHeaders.get("content-encoding")?.toLowerCase();
+        const decoder = encoding === "gzip" ? createGunzip()
+          : encoding === "deflate" ? createInflate()
+          : encoding === "br" ? createBrotliDecompress() : null;
+        if (decoder) {
+          responseHeaders.delete("content-encoding");
+          responseHeaders.delete("content-length");
+          incoming.on("error", (error) => decoder.destroy(error));
+          decoder.once("close", () => incoming.destroy());
+        }
+        const stream = decoder ? incoming.pipe(decoder) : incoming;
+        resolve(new Response(Readable.toWeb(stream) as unknown as ReadableStream<Uint8Array>, {
+          status, statusText: incoming.statusMessage, headers: responseHeaders,
+        }));
+      } catch (error) {
+        incoming.destroy();
+        reject(error);
+      }
+    });
+    request.once("error", reject);
+    if (init.body !== undefined && init.body !== null) request.write(init.body);
+    request.end();
+  });
+}

package/src/cli/pane-functions/screenshot-render.ts

@@ -1,8 +1,7 @@
 import { logFailure } from "../../utils/log-failure";
 import { apiClient } from "../../api-client";
 import { loadResolvedHeadlessPaneModel, reportCoverage, reportGaps, type LoadedHeadlessPaneModel } from "./headless";
-import { dirname } from "path";
-import { mkdir } from "fs/promises";
+import { createOutputFolder } from "../output-file";
 import type { Quote } from "../../types/financials";
 import { isRecord } from "../../utils/guards";
 import {
@@ -28,7 +27,18 @@ import { quotesFreshness } from "../freshness";
 import { paneFitsRows, shotMaxHeightCells, buildDesktopShotPayload } from "./screenshot-payload";
 import { resolveDesktopShotApiProxy, createDesktopShotBridge } from "./screenshot-bridge";
 import type { PaneScreenshotResult } from "./screenshot-types";
-import { assessPaneScreenshot } from "./screenshot-assessment";
+import { assessPaneScreenshot, shotLoadedNothing } from "./screenshot-assessment";
+
+/**
+ * Whether a capture's footer keeps a row for the dated status line. A pane of
+ * the user's own state (notes, connections, documentation) declares `local`:
+ * it has no data to date, and "not a live feed" would be said of its own
+ * state. A capture that loaded nothing gives the row back later
+ * (`shotLoadedNothing`).
+ */
+export function shotHasStatusLine(resolved: Pick<ResolvedPaneFunction, "pane" | "template">): boolean {
+  return !declaredReportFreshness(resolved).local;
+}
 
 /** The bridge, keeping every quote it serves the page: what a pane that loads its own quotes (WEI) shows. */
 function recordBridgedQuotes(bridge: DesktopPaneShotBridge): { bridge: DesktopPaneShotBridge; quotes: Quote[] } {
@@ -241,7 +251,7 @@ export async function renderDesktopShot({
    */
   onStalledReport?: () => void;
 }): Promise<PaneScreenshotResult> {
-  if (captureImage) await mkdir(dirname(outputPath), { recursive: true });
+  if (captureImage) await createOutputFolder(outputPath);
   const apiProxy = resolveDesktopShotApiProxy(context);
   const previousSessionToken = apiClient.getSessionToken();
   let payload: DesktopPaneShotPayload;
@@ -277,7 +287,7 @@ export async function renderDesktopShot({
       watermark ?? null,
       loadModel,
     );
-    if (statusLine && captureImage) payload.statusLine = true;
+    if (statusLine && captureImage && shotHasStatusLine(resolved)) payload.statusLine = true;
     const fitRoles = [
       ...(fitRows && paneFitsRows(resolved) ? ["data-table-body-scroll"] : []),
       ...(fitReader && resolved.pane.shotFitsReader ? ["detail-scroll-body"] : []),
@@ -296,6 +306,10 @@ export async function renderDesktopShot({
       captureImage,
       bridge: recorded.bridge,
       statusLine: async (rendered) => {
+        if (shotLoadedNothing(rendered)) {
+          abandonReports();
+          return null;
+        }
         const tab = report && shownReportTab(resolved, rendered.semanticUi);
         const shown = tab ? reportShotFreshness(resolved, () => loadReport({ ...resolved, options: { ...resolved.options, tab } })) : report;
         const line = shotFreshness(resolved, shotPayload, rendered, recorded.quotes, shown && await settledWithin(shown, SHOT_REPORT_WAIT_MS));

package/src/cli/quote-answer.ts

@@ -2,6 +2,7 @@ import type { QuoteBatchResult } from "../types/data-provider";
 import type { Quote } from "../types/financials";
 import { bareListingNote } from "../tickers/listing-fate";
 import { notATickerSymbol } from "../sources/provider-errors";
+import { listingSuffixCandidate } from "../sources/listing-symbols";
 import { looksLikeCurrencyPair } from "../utils/currency-pair";
 import { canonicalExchange } from "../utils/exchanges";
 import type { CliCommandDef } from "../types/plugin";
@@ -102,6 +103,9 @@ export async function answerQuote(
   const notTraded = await notTradedMessage(listing, market);
   if (notTraded) return { result, listing, failure: { message: notTraded, oneLine: notTraded }, notes: [] };
   if (!isNoProviderError(result.error)) return { result, listing, notes: [] };
+  // HCI.L is HCI on LSE written with a vendor's suffix: one that does not trade there says so as HCI:LSE does.
+  const suffixed = await notTradedOnSuffixVenue(listing, market);
+  if (suffixed) return { result, listing, failure: { message: suffixed, oneLine: suffixed }, notes: [] };
   // A word the service marks as a company's name is that company, before the symbol is read on its listings abroad.
   const named = !listing.exchange && listing.typed ? await serviceNamedCompany(listing.typed, market) : null;
   const meant = named ? await answerNamedListing(named, market, request, refresh, datesChangeBasis) : null;
@@ -137,6 +141,22 @@ export async function answerQuote(
   return { result, listing, failure: { message, details, oneLine }, notes: [] };
 }
 
+/**
+ * "HCI does not trade on LSE. HCI trades on: NYSE, IEX, JSE." for a symbol
+ * written with a venue's suffix (HCI.L) that no source quotes, when its base
+ * symbol trades elsewhere and not on the venue the suffix names: the answer
+ * `HCI:LSE` gets. Only for London's `.L` and suffixes of two letters or more
+ * (`.IS`, `.JO`): another one-letter suffix is as likely a US share class
+ * (MKC.V, BRK.B) and keeps its own answer. Null otherwise.
+ */
+async function notTradedOnSuffixVenue(listing: CliListing, market: MarketContext): Promise<string | null> {
+  if (listing.exchange) return null;
+  const suffix = listing.symbol.slice(listing.symbol.lastIndexOf(".") + 1);
+  if (!listing.symbol.includes(".") || (suffix.length < 2 && suffix.toUpperCase() !== "L")) return null;
+  const venue = listingSuffixCandidate(listing.symbol);
+  return venue ? notTradedMessage(venue, market) : null;
+}
+
 /**
  * A company's name typed as one word (`Apple`) that the source says is not a
  * ticker, answered as the listing search names for it with the line saying so

package/src/cli/registry.ts

@@ -6,7 +6,7 @@ import type {
   GloomPlugin,
 } from "../types/plugin";
 import type { LoadedExternalPlugin } from "../plugins/loader";
-import { getPluginCatalog } from "../plugins/catalog";
+import { getBuiltinCliCommands } from "../plugins/catalog-cli";
 import { initCliServices, initConfigData, initMarketData } from "./context";
 import { closeAndFail, fail } from "./errors";
 import { DEFAULT_CLI_OPTIONS, type CliGlobalOptions } from "./options";
@@ -38,11 +38,14 @@ export interface CliCommandRegistry {
   config: AppConfig | null;
   plugins: GloomPlugin[];
   externalPlugins: LoadedExternalPlugin[];
+  /** Loads installed contributions when dispatch or application services need them. */
+  ensureExternalPlugins?: () => Promise<void>;
 }
 
 interface BuildCliCommandRegistryOptions {
   coreCommands: CliCommandDef[];
   externalPlugins?: LoadedExternalPlugin[];
+  loadExternalPlugins?: () => Promise<LoadedExternalPlugin[]>;
   config?: AppConfig | null;
 }
 
@@ -72,11 +75,11 @@ export function normalizeCliDispatchResult(result: void | CliDispatchResult): Cl
 export function buildCliCommandRegistry({
   coreCommands,
   externalPlugins = [],
+  loadExternalPlugins,
   config = null,
 }: BuildCliCommandRegistryOptions): CliCommandRegistry {
   const allCommands: RegisteredCliCommand[] = [];
   const allTokens = new Map<string, RegisteredCliCommand>();
-  const catalog = getPluginCatalog(externalPlugins);
   const disabledPlugins = new Set(config?.disabledPlugins ?? []);
 
   const registerCommand = (
@@ -110,8 +113,10 @@ export function buildCliCommandRegistry({
     registerCommand(command, "core", "core", true);
   }
 
-  const loadablePlugins: GloomPlugin[] = [];
-  for (const entry of catalog) {
+  for (const { pluginId, commands } of getBuiltinCliCommands()) {
+    for (const command of commands) registerCommand(command, pluginId, "plugin", true);
+  }
+  for (const entry of externalPlugins) {
     if (entry.error) {
       registryLog.warn(`Skipping external plugin "${entry.plugin.id}" for CLI registration.`, {
         path: entry.path,
@@ -119,9 +124,8 @@ export function buildCliCommandRegistry({
       });
       continue;
     }
-    loadablePlugins.push(entry.plugin);
     for (const command of entry.plugin.cliCommands ?? []) {
-      registerCommand(command, entry.plugin.id, "plugin", entry.source === "builtin");
+      registerCommand(command, entry.plugin.id, "plugin", false);
     }
   }
 
@@ -137,30 +141,54 @@ export function buildCliCommandRegistry({
     }
   }
 
-  return {
+  let plugins: GloomPlugin[] | undefined;
+  let loading: Promise<void> | undefined;
+  const registry: CliCommandRegistry = {
     commands,
     lookup,
     config,
-    plugins: loadablePlugins.filter((plugin) => !disabledPlugins.has(plugin.id)),
+    get plugins() {
+      const { getPluginCatalog } = require("../plugins/catalog") as typeof import("../plugins/catalog");
+      return plugins ??= getPluginCatalog(registry.externalPlugins)
+        .filter((entry) => !entry.error && !disabledPlugins.has(entry.plugin.id))
+        .map((entry) => entry.plugin);
+    },
     externalPlugins,
+    ...(loadExternalPlugins ? { ensureExternalPlugins: () => loading ??= (async () => {
+      const loaded = await loadExternalPlugins();
+      const expanded = buildCliCommandRegistry({ coreCommands, externalPlugins: loaded, config });
+      registry.commands = expanded.commands;
+      registry.lookup = expanded.lookup;
+      registry.externalPlugins = loaded;
+      // A command can retain ctx.plugins before opening market data (search does).
+      // Keep that reference current without materializing panes for command-only work.
+      if (plugins) plugins.splice(0, plugins.length, ...expanded.plugins);
+    })() } : {}),
   };
+  return registry;
 }
 
 export function createCliCommandContext(
   ownerId: string,
-  registryOrPlugins: Pick<CliCommandRegistry, "plugins" | "externalPlugins"> | GloomPlugin[],
+  registryOrPlugins: Pick<CliCommandRegistry, "plugins" | "externalPlugins" | "ensureExternalPlugins"> | GloomPlugin[],
   cliOptions: CliGlobalOptions = DEFAULT_CLI_OPTIONS,
   args: readonly string[] = [],
 ): CliCommandContext {
-  const registry = Array.isArray(registryOrPlugins)
+  const registry: Pick<CliCommandRegistry, "plugins" | "externalPlugins" | "ensureExternalPlugins"> = Array.isArray(registryOrPlugins)
     ? { plugins: registryOrPlugins, externalPlugins: [] }
     : registryOrPlugins;
   return {
     initConfigData,
-    initMarketData: () => initMarketData({ plugins: registry.plugins }),
-    initServices: () => initCliServices({ externalPlugins: registry.externalPlugins }),
+    initMarketData: async () => {
+      await registry.ensureExternalPlugins?.();
+      return initMarketData({ plugins: registry.plugins });
+    },
+    initServices: async () => {
+      await registry.ensureExternalPlugins?.();
+      return initCliServices({ externalPlugins: registry.externalPlugins });
+    },
     cliOptions,
-    plugins: registry.plugins,
+    get plugins() { return registry.plugins; },
     fail,
     closeAndFail,
     output: {

package/src/cli/result.ts

@@ -93,6 +93,8 @@ export interface CliResultRenderOptions<T = unknown, Row = Record<string, unknow
   heading?: string;
   /** Text-mode line printed under the rows, such as where a listing stops. Not printed with no rows: say it in `empty`. */
   footnote?: string;
+  /** Text-mode line under each table row, indented and muted, cut to the width: a story's summary under its headline. */
+  rowNote?: (row: Row) => string | null | undefined;
   /** Text-mode block printed under the rows and footnote, for figures about a row that are not columns. */
   details?: (data: T) => string;
   /**
@@ -446,6 +448,7 @@ function formatTextCell<Row extends Record<string, unknown>>(
 function renderTextTable<Row extends Record<string, unknown>>(
   rows: Row[],
   columns?: CliResultColumn<Row>[],
+  rowNote?: (row: Row) => string | null | undefined,
 ): string {
   const resolvedColumns = textColumns(rows, columns);
   const cells = rows.map((row) => resolvedColumns.map((column) => formatTextCell(column, row, "table")));
@@ -469,6 +472,7 @@ function renderTextTable<Row extends Record<string, unknown>>(
       stackRows: column.stackRows,
     })),
     cells.map((row) => shown.map(({ index }) => row[index]!)),
+    rowNote ? { below: rows.map((row) => { const note = rowNote(row); return note ? [note] : []; }), cutBelow: true } : {},
   );
 }
 
@@ -581,15 +585,16 @@ function serializeCliRows<T, Row extends Record<string, unknown>>(
   if (renderOptions.text) {
     return renderOptions.text(result.data);
   }
-  const summary = renderOptions.summary?.(result.data) ?? "";
-  const withHeading = (text: string) => renderOptions.heading ? `${renderOptions.heading}\n${text}` : text;
+  // The heading's lines, the summary and the notes are prose: each wraps to a narrow --width, as the source line does.
+  const summary = wrapToTerminal(renderOptions.summary?.(result.data) ?? "");
+  const withHeading = (text: string) => renderOptions.heading ? `${wrapToTerminal(renderOptions.heading)}\n${text}` : text;
   if (rows.length === 0) {
-    return withHeading(summary || cliStyles.muted(renderOptions.empty ?? "No results."));
+    return withHeading(summary || cliStyles.muted(wrapToTerminal(renderOptions.empty ?? "No results.")));
   }
   const table = renderTextRows(rows as Row[], result.data, renderOptions);
   const notes = [window.note, renderOptions.footnote].filter((note): note is string => !!note);
   const details = renderOptions.details?.(result.data) ?? "";
-  const body = [table, ...notes.map((note) => cliStyles.muted(note)), ...details ? ["", details] : []].join("\n");
+  const body = [table, ...notes.map((note) => cliStyles.muted(wrapToTerminal(note))), ...details ? ["", details] : []].join("\n");
   return withHeading(summary ? `${summary}\n\n${body}` : body);
 }
 
@@ -607,7 +612,7 @@ function renderTextRows<T, Row extends Record<string, unknown>>(
   }
   return layout === "record"
     ? renderTextRecords(rows as Row[], columns)
-    : renderTextTable(rows as Row[], columns);
+    : renderTextTable(rows as Row[], columns, renderOptions.rowNote);
 }
 
 /** Settles once the result `printCliResult` last wrote has left the process: a pipe can hold it back. */
@@ -640,8 +645,9 @@ export function printCliResult<T, Row extends Record<string, unknown> = Record<s
   // JSON carries warnings in its envelope. Text, CSV and NDJSON are only the
   // rows, so a warning goes to stderr, out of a file the rows are piped into.
   if (options.format !== "json" && !options.quiet) {
+    // Each wraps to a narrow --width, as a note does.
     for (const warning of result.warnings ?? []) {
-      console.error(`${cliStyles.warning("warning:")} ${hinted(warning)}`);
+      console.error(wrapToTerminal(`${cliStyles.warning("warning:")} ${hinted(warning)}`));
     }
   }
   // CSV says what its rows do not in closing `# note:` lines; NDJSON has no place for one among its rows,

package/src/cli/ticker-resolution.ts

@@ -139,7 +139,8 @@ export interface CliTickerOptions {
  */
 export class CoinListingError extends ListingArgError {
   constructor(message: string, details: string, readonly hint: string) {
-    super(message, `${details}\n${hint}`);
+    // A listing message that already ends in the coin note (`describeOtherListings`) keeps it once.
+    super(message, details.endsWith(hint) ? details : `${details}\n${hint}`);
     this.name = "CoinListingError";
   }
 }

package/src/cli/types.ts

@@ -21,6 +21,8 @@ export type MarketContext = ConfigContext & {
   seriesCapabilities?: CapabilityInvoker;
   /** The catalog series charted as an expression (`FRED:DFII10`), in a report run without the plugin runtime. */
   findCatalogSeries?: (expression: string) => import("../series/types").SeriesDefinition | undefined;
+  /** The catalog series a bare word is an alias of (`hashrate`), in a report run without the plugin runtime. */
+  findCatalogSeriesNamed?: (word: string) => import("../series/types").SeriesDefinition | undefined;
   /** `--refresh`: prefetched data bypasses the local cache. */
   refresh?: boolean;
   /** Filings behind the statements and a bank's figures, read from Gloom Cloud; absent where the data service is a stand-in. */

package/src/components/chart/composite/format.ts

@@ -49,6 +49,7 @@ function formatFullCurrencyValue(
   options: MarketFormatOptions = {},
 ): string | null {
   if (unit.trim() === INDEX_POINTS_UNIT) return formatMarketPrice(value, { ...options, assetCategory, priceBasis: "points" });
+  if (unit.trim() === "32nds") return formatMarketPrice(value, { ...options, assetCategory, priceBasis: "thirty-seconds" });
   const currency = unitCurrencyCode(unit);
   return currency ? formatMarketPriceWithCurrency(value, currency, { ...options, assetCategory }) : null;
 }
@@ -362,6 +363,8 @@ export function formatCompositeAxisValue(value: number, domain: CompositeAxisDom
   // Derived dimensions are included in the legend value. Axis labels stay
   // numeric so a narrow gutter cannot truncate USD/JPY into a false USD label.
   if (group.startsWith("derived-unit:")) return compact;
+  // Treasury prices keep their whole points and 32nds at every zoom level.
+  if (domain.unit.trim() === "32nds") return formatAxisPriceValue(value, domain);
   // Compact labels suit a wide view, but a zoomed one can hold several ticks
   // inside a single rounding step and print one repeated price down the gutter.
   // Where that happens the axis spends the digits needed to tell them apart,