moshcode 0.24.0

package/src/ui.mjs

@@ -0,0 +1,49 @@
+// Metal terminal styling — poison acid-lime (#9EF01A) on near-black, the
+// moshcoding palette. Truecolor ANSI with a NO_COLOR opt-out.
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/** moshcode's own version, read from package.json (best-effort). */
+export function moshcodeVersion() {
+  try {
+    const pkg = fileURLToPath(new URL("../package.json", import.meta.url));
+    return JSON.parse(fs.readFileSync(pkg, "utf8")).version || null;
+  } catch { return null; }
+}
+
+const useColor = process.env.NO_COLOR == null && process.stdout.isTTY === true;
+const rgb = (r, g, b) => (s) => (useColor ? `\x1b[38;2;${r};${g};${b}m${s}\x1b[39m` : String(s));
+const wrap = (o, c) => (s) => (useColor ? `\x1b[${o}m${s}\x1b[${c}m` : String(s));
+
+export const acid = rgb(158, 240, 26);
+export const bone = rgb(238, 242, 232);
+export const ash = rgb(139, 147, 138);
+export const danger = rgb(255, 77, 61);
+export const amber = rgb(255, 213, 61);
+export const spotify = rgb(29, 185, 84);
+export const dim = wrap(2, 22);
+
+export const ok = (s) => acid("✓ ") + s;
+export const err = (s) => danger("✗ ") + s;
+export const warn = (s) => amber("⚠ ") + s;
+export const info = (s) => ash("· ") + s;
+
+export function banner() {
+  const version = moshcodeVersion();
+  const name = bone("moshcode") + (version ? ash(" v" + version) : "");
+  return [
+    acid("  ███╗   ███╗ ██████╗ ███████╗██╗  ██╗"),
+    acid("  ████╗ ████║██╔═══██╗██╔════╝██║  ██║") + ash("   code hard,"),
+    acid("  ██╔████╔██║██║   ██║███████╗███████║") + ash("   mosh harder"),
+    acid("  ██║╚██╔╝██║██║   ██║╚════██║██╔══██║"),
+    acid("  ██║ ╚═╝ ██║╚██████╔╝███████║██║  ██║") + dim("  ⚡ #moshcoding"),
+    acid("  ╚═╝     ╚═╝ ╚═════╝ ╚══════╝╚═╝  ╚═╝"),
+    "",
+    "  " + name + ash("  ·  a wall of distortion for your coding agents"),
+    "  " + acid("https://moshcode.sh"),
+  ].join("\n");
+}
+
+export function hr() {
+  return ash("─".repeat(Math.min(process.stdout.columns || 60, 60)));
+}

package/src/uninstall.mjs

@@ -0,0 +1,113 @@
+// Taking a tool back off the machine.
+//
+// `moshcode install` runs whatever each tool ships as its installer, and those
+// come in two shapes: `npm install -g <pkg>`, and `curl … | sh`. Only the first
+// has an inverse anyone wrote down. The second drops a binary somewhere and
+// leaves no record, so removing it means finding that binary and deleting it —
+// which is a different kind of operation and is treated like one here.
+//
+// The rules that follow from that:
+//
+//   - an npm install is undone by npm, which knows what it put where
+//   - a script install is undone by removing the binary the tool reports, and
+//     only when it sits somewhere a per-user installer would plausibly have put
+//     it. `/usr/bin/git` is not something this should ever offer to delete
+//   - anything else says so rather than guessing
+//
+// Plans are data so the whole decision is testable without deleting anything,
+// and so `--dry-run` can show exactly what would go.
+
+import { dirname } from "node:path";
+import { homedir } from "node:os";
+
+/**
+ * Where a per-user installer legitimately puts a binary.
+ *
+ * A deny-list would be the wrong shape here: the question is not "is this
+ * dangerous" but "did something we ran plausibly create this", and only an
+ * allow-list answers that. A binary in /usr/bin arrived from the system package
+ * manager and is not ours to remove.
+ */
+export function safePrefixes(home = homedir()) {
+  return [
+    `${home}/.local/bin`,
+    `${home}/.bun/bin`,
+    `${home}/.cargo/bin`,
+    `${home}/.deno/bin`,
+    `${home}/bin`,
+    `${home}/.npm-global/bin`,
+    `${home}/.volta/bin`,
+    `${home}/go/bin`,
+    "/usr/local/bin",
+    "/opt/homebrew/bin",
+  ];
+}
+
+/** The npm package an install spec would install, or null if it is not npm. */
+export function npmPackageOf(install) {
+  if (!install) return null;
+  const npmish = ["npm", "pnpm", "yarn", "bun"].includes(install.cmd);
+  if (!npmish) return null;
+  const args = install.args || [];
+  if (!args.includes("-g") && !args.includes("--global")) return null;
+  // The package is the last argument that is not a flag or a subcommand.
+  const skip = new Set(["install", "add", "i", "-g", "--global"]);
+  const pkg = [...args].reverse().find((a) => !a.startsWith("-") && !skip.has(a));
+  return pkg || null;
+}
+
+/**
+ * How to remove `entry`, given where its binary currently is.
+ *
+ * `binPath` is what `which <bin>` reported, or null when it is not on PATH.
+ */
+export function uninstallPlan(entry, { binPath = null, home = homedir() } = {}) {
+  const pkg = npmPackageOf(entry?.install);
+  if (pkg) {
+    return {
+      kind: "npm",
+      steps: [{ kind: "run", command: entry.install.cmd, args: ["uninstall", "-g", pkg] }],
+      warnings: [],
+    };
+  }
+
+  if (!binPath) {
+    return {
+      kind: "absent",
+      steps: [],
+      warnings: [`${entry?.bin || "it"} is not on your PATH — nothing to remove`],
+    };
+  }
+
+  const dir = dirname(binPath);
+  if (!safePrefixes(home).includes(dir)) {
+    // Refused rather than confirmed-with-a-scary-prompt: a binary here came
+    // from somewhere else, and the person who put it there knows how to remove
+    // it. Deleting it because a prompt was clicked through is worse than not
+    // offering.
+    return {
+      kind: "refused",
+      steps: [],
+      warnings: [
+        `${binPath} is not in a directory moshcode installs into.`,
+        "It was put there by something else — a system package manager, or by hand — so removing it is that thing's job.",
+      ],
+    };
+  }
+
+  return {
+    kind: "binary",
+    steps: [{ kind: "remove", path: binPath }],
+    warnings: [
+      "This removes the binary only. Anything it wrote to your home directory — config, caches, credentials — stays.",
+    ],
+  };
+}
+
+/** The plan as a line someone can read before agreeing to it. */
+export function describeUninstall(plan) {
+  return plan.steps
+    .map((s) => (s.kind === "run" ? `run     ${s.command} ${s.args.join(" ")}` : `remove  ${s.path}`))
+    .concat((plan.warnings || []).map((w) => `note    ${w}`))
+    .join("\n");
+}

package/src/upgrade.mjs

@@ -0,0 +1,217 @@
+// `moshcode upgrade` — update everything that has a newer version: moshcode,
+// installed coding engines, and installed workflow tools. Conductor pattern:
+// re-run each target's own updater/installer (they fetch latest), never vendor.
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import fs from "node:fs";
+import { ENGINES, engineStatus, exitReason, ranOk, resolveEngine, upgradeSpec, runCmd } from "./engines.mjs";
+import { TOOLS, resolveTool, toolStatus, toolUpgradeSpec } from "./tools.mjs";
+
+// Self-upgrade re-runs the moshcode installer's `update` path. Defaults to the
+// GitHub-hosted install.sh (always live); override with MOSHCODE_INSTALL_URL.
+const SELF_URL = process.env.MOSHCODE_INSTALL_URL
+  || "https://raw.githubusercontent.com/moshcoder/moshcode/main/install.sh";
+
+// Where the *running* moshcode actually lives (…/<home>/src/upgrade.mjs → <home>).
+// We point the installer at this so it updates THIS copy in place, not a default
+// path that might not be the one on your PATH.
+export const MOSHCODE_HOME = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+// Running from a git checkout? Then a reinstall would blow away the working tree
+// — update it with `git pull`, not the installer.
+function isGitCheckout(dir) {
+  return fs.existsSync(path.join(dir, ".git"));
+}
+
+function selfVersion() {
+  try { return JSON.parse(fs.readFileSync(path.join(MOSHCODE_HOME, "package.json"), "utf8")).version || null; }
+  catch { return null; }
+}
+
+// POSIX-safe single-quoting for values embedded in the `sh -c` command line:
+// wrap in '…' and escape every ' as '\'' . Without this an apostrophe in the
+// install path (e.g. /Users/o'brien/moshcode) broke self-upgrade with a shell
+// syntax error — and a hostile path could break out of the quotes and inject
+// extra shell into the update command.
+const shQ = (value) => `'${String(value).replace(/'/g, `'\\''`)}'`;
+
+export function selfSpec(home = MOSHCODE_HOME, url = SELF_URL) {
+  // Export MOSHCODE_HOME so install.sh updates the exact dir we run from.
+  return { cmd: "sh", args: ["-c", `export MOSHCODE_HOME=${shQ(home)}; curl -fsSL ${shQ(url)} | sh -s -- update`] };
+}
+
+/**
+ * Work out an upgrade plan from optional targets:
+ *   []/["all"]            → moshcode + every installed engine and tool
+ *   ["self"|"moshcode"]   → moshcode only
+ *   ["engines"]           → all installed engines (no self)
+ *   ["tools"]             → all installed tools (no self)
+ *   ["claude"|"ugig", …] → named targets (install if not present yet)
+ * Returns { self, items:[{key,label,kind,spec,installed}], unknown:[] }.
+ */
+export function planUpgrade(targets = []) {
+  const t = targets.map((x) => String(x).trim().toLowerCase()).filter(Boolean);
+  const engines = engineStatus();
+  const tools = toolStatus();
+  const engineByKey = Object.fromEntries(engines.map((entry) => [entry.key, entry]));
+  const toolByKey = Object.fromEntries(tools.map((entry) => [entry.key, entry]));
+
+  const wantsAll = t.length === 0 || t.includes("all");
+  const wantsSelf = wantsAll || t.includes("self") || t.includes("moshcode");
+  const wantsEngines = wantsAll || t.includes("engines");
+  const wantsTools = wantsAll || t.includes("tools");
+
+  const items = [];
+  const unknown = [];
+  const seen = new Set();
+
+  // A native updater (`doppler update`, `aider --upgrade`) is the missing
+  // binary itself, so it cannot be what installs it. When the target is not
+  // present yet, run its installer — that is the command the "(installing —
+  // not present)" note below promises. Installed targets keep the native
+  // updater, which is the whole point of having one.
+  const addEngine = (key) => {
+    const id = `engine:${key}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    const installed = engineByKey[key].installed;
+    items.push({
+      key,
+      label: key,
+      kind: "engine",
+      spec: installed ? upgradeSpec(ENGINES[key]) : ENGINES[key].install,
+      // Where to turn when a native updater refuses. Only set when the updater
+      // is something other than the installer, so a fallback can never repeat
+      // the command that just failed.
+      fallback: installed && upgradeSpec(ENGINES[key]) !== ENGINES[key].install ? ENGINES[key].install : null,
+      installed,
+    });
+  };
+  const addTool = (key) => {
+    const id = `tool:${key}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    const installed = toolByKey[key].installed;
+    items.push({
+      key,
+      label: key,
+      kind: "tool",
+      spec: installed ? toolUpgradeSpec(TOOLS[key]) : TOOLS[key].install,
+      fallback: installed && toolUpgradeSpec(TOOLS[key]) !== TOOLS[key].install ? TOOLS[key].install : null,
+      installed,
+    });
+  };
+
+  if (wantsEngines) {
+    for (const engine of engines) if (engine.installed) addEngine(engine.key);
+  }
+  if (wantsTools) {
+    for (const tool of tools) if (tool.installed) addTool(tool.key);
+  }
+  // Explicit names/engine aliases upgrade even when not currently installed.
+  for (const tok of t) {
+    if (["all", "self", "moshcode", "engines", "tools"].includes(tok)) continue;
+    const engine = resolveEngine(tok);
+    const tool = resolveTool(tok);
+    if (engine) addEngine(engine[0]);
+    else if (tool) addTool(tool[0]);
+    else unknown.push(tok);
+  }
+
+  return { self: wantsSelf, items, unknown };
+}
+
+/**
+ * Run an upgrade plan sequentially, streaming each tool's own output. `io.log`
+ * prints a status line, `io.rule` draws a divider around each hand-off (both
+ * optional — default to plain console output). Returns a summary array.
+ */
+export async function runUpgrade(targets = [], io = {}) {
+  const log = io.log || ((s) => console.log(s));
+  const rule = io.rule || (() => console.log("─".repeat(48)));
+
+  // `sudo moshcode update` is the one escalation this CLI must never accept.
+  // selfSpec re-runs the installer, and every path the installer uses comes
+  // from $HOME — which sudo has set to /root. The update "succeeds", moshcode
+  // is reinstalled into root's home, and the operator is left with a binary on
+  // PATH they cannot execute. Engine and tool installers have the same shape:
+  // they write into $HOME too.
+  //
+  // A bare root shell has no SUDO_USER and is a legitimate place to run this,
+  // so only the escalated-from-a-real-user case is refused.
+  const uid = io.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
+  const env = io.env || process.env;
+  if (uid === 0 && env.SUDO_USER && !env.MOSHCODE_ALLOW_ROOT) {
+    log(`✗ don't run moshcode update with sudo.`);
+    log("");
+    log(`  It reinstalls moshcode, and the installer puts everything under $HOME —`);
+    log(`  which sudo has set to ${env.HOME || "/root"}. That would install moshcode for`);
+    log(`  root and leave ${env.SUDO_USER} with a moshcode on PATH it cannot execute.`);
+    log("");
+    log("  Run it as yourself instead:");
+    log("      moshcode update");
+    log("");
+    log("  Commands that genuinely need root, like `dns enable`, now ask for it");
+    log("  themselves — you do not need to escalate the whole CLI for those.");
+    return [{ name: "moshcode", ok: false, code: 1, signal: null }];
+  }
+
+  const { self, items, unknown } = planUpgrade(targets);
+
+  for (const u of unknown) log(`? skipping unknown upgrade target "${u}"`);
+
+  if (!self && items.length === 0) {
+    if (!unknown.length) log("nothing to upgrade — no matching engines or tools are installed.");
+    return [];
+  }
+
+  const exec = io.runCmd || runCmd;
+
+  const results = [];
+  const attempt = async (name, spec, note) => {
+    log(`\n⬆ upgrading ${name}${note ? ` ${note}` : ""} — ${spec.cmd} ${spec.args.join(" ")}`);
+    rule();
+    const r = await exec(spec.cmd, spec.args);
+    rule();
+    const ok = ranOk(r);
+    log(ok ? `✓ ${name} up to date` : `✗ ${name} upgrade failed (${exitReason(r)})`);
+    return { name, ok, code: r.code, signal: r.signal ?? null };
+  };
+  const run = async (name, spec, note) => {
+    const result = await attempt(name, spec, note);
+    results.push(result);
+    return result.ok;
+  };
+
+  if (self) {
+    if (isGitCheckout(MOSHCODE_HOME)) {
+      // Don't reinstall over a working tree — just tell the user how to update it.
+      log(`\n· moshcode runs from a git checkout (${MOSHCODE_HOME}) — \`git pull\` there to update it (skipping self-reinstall).`);
+    } else {
+      const before = selfVersion();
+      const ok = await run("moshcode", selfSpec(), "(self)");
+      const after = selfVersion();
+      if (ok && before && after) {
+        log(before === after ? `· moshcode already at ${after}` : `· moshcode ${before} → ${after} — restart moshcode to load it.`);
+      }
+    }
+  }
+  for (const it of items) {
+    const result = await attempt(it.label, it.spec, it.installed ? "" : "(installing — not present)");
+    // A native updater that can't tell how the binary got there fails the same
+    // way on every run — an opencode fork living under its own directory, a
+    // binary someone moved, a machine where the installer left no marker. The
+    // installer is idempotent and fetches the latest, so reach for it rather
+    // than leaving the target stranded on an old version.
+    if (!result.ok && it.fallback) {
+      log(`· ${it.label}'s own updater could not do it — falling back to its installer`);
+      results.push(await attempt(it.label, it.fallback, "(installer)"));
+      continue;
+    }
+    results.push(result);
+  }
+
+  const failed = results.filter((r) => !r.ok);
+  log(`\n${failed.length ? "✗" : "✓"} upgraded ${results.length - failed.length}/${results.length}${failed.length ? ` — failed: ${failed.map((r) => r.name).join(", ")}` : "."} 🤘`);
+  return results;
+}