moshcode 0.24.3 → 0.25.1

package/README.md

@@ -76,8 +76,8 @@ use this only in an isolated container, VM, or workspace you trust:
 
 ```sh
 moshcode agents claude      # claude agents --dangerously-skip-permissions  (agent view)
-moshcode agents opencode    # opencode agent list                          (agent view)
-moshcode agents privacycode # privacycode agent list                       (agent view)
+moshcode agents opencode    # opencode --auto                              (autonomous)
+moshcode agents privacycode # privacycode --auto                           (autonomous)
 moshcode agents codex       # codex --dangerously-bypass-approvals-and-sandbox  (autonomous)
 moshcode agents gemini      # gemini --approval-mode=yolo                       (autonomous)
 moshcode agents kimi        # kimi --yolo                                       (autonomous)

package/bin/moshcode.mjs

@@ -546,7 +546,15 @@ async function main() {
     } catch (e) { console.error(String(e.message || e)); process.exitCode = 1; }
     return;
   }
-  if (cmd === "whoami") { await whoami(); return; }
+  if (cmd === "whoami") {
+    if (rest.length > 1 || (rest.length === 1 && rest[0] !== "--json")) {
+      console.error("usage: moshcode whoami [--json]");
+      process.exitCode = 1;
+      return;
+    }
+    await whoami({ json: rest[0] === "--json" });
+    return;
+  }
   if (cmd === "logout") { logout(); return; }
   if (cmd === "run") {
     let max = 3, dryRun = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.24.3",
+  "version": "0.25.1",
   "type": "module",
   "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {
@@ -12,8 +12,8 @@
     "url": "https://github.com/moshcoder/moshcode/issues"
   },
   "bin": {
-    "moshcode": "./bin/moshcode.mjs",
-    "moshscript": "./bin/moshscript.mjs"
+    "moshcode": "bin/moshcode.mjs",
+    "moshscript": "bin/moshscript.mjs"
   },
   "scripts": {
     "start": "node bin/moshcode.mjs",

package/src/auth.mjs

@@ -167,22 +167,88 @@ export async function loginAuto({ device = false, browser = false } = {}) {
 }
 
 /** Print who is logged in (verified against the app). */
-export async function whoami() {
+export async function whoami({ json = false } = {}) {
   const creds = loadCreds();
-  if (!creds?.token) { console.log("not logged in — run: moshcode login"); return; }
+  if (!creds?.token) {
+    if (json) {
+      console.log(JSON.stringify({
+        status: "not_logged_in",
+        verified: false,
+        api: API(),
+        user: null,
+      }, null, 2));
+    } else {
+      console.log("not logged in — run: moshcode login");
+    }
+    return;
+  }
+  const api = creds.api || API();
+  const localUser = {
+    id: creds.id ?? null,
+    email: creds.email ?? null,
+    name: null,
+    credits: null,
+  };
+  const printJson = (value) => console.log(JSON.stringify(value, null, 2));
   try {
-    const res = await fetch(`${creds.api || API()}/api/me`, { headers: { authorization: `Bearer ${creds.token}` } });
-    if (res.status === 401) { console.log("session expired — run: moshcode login"); return; }
+    const res = await fetch(`${api}/api/me`, { headers: { authorization: `Bearer ${creds.token}` } });
+    if (res.status === 401) {
+      if (json) {
+        printJson({
+          status: "expired",
+          verified: false,
+          api,
+          user: localUser,
+          error: { type: "auth", status: 401 },
+        });
+      }
+      else console.log("session expired — run: moshcode login");
+      return;
+    }
     // Any other error status still has a body, and it isn't an account — reading
     // it as one prints a made-up identity for a session the app just refused.
     if (!res.ok) {
-      console.log(`${creds.email || "logged in"} @ ${creds.api || API()} (couldn't verify — the app returned ${res.status})`);
+      if (json) {
+        printJson({
+          status: "unverified",
+          verified: false,
+          api,
+          user: localUser,
+          error: { type: "http", status: res.status },
+        });
+      } else {
+        console.log(`${creds.email || "logged in"} @ ${api} (couldn't verify — the app returned ${res.status})`);
+      }
       return;
     }
     const me = await res.json();
-    console.log(`${me.email || me.name || "moshcoder"} 🤘  (${me.credits ?? "?"} credits)  @ ${creds.api || API()}`);
+    if (json) {
+      printJson({
+        status: "authenticated",
+        verified: true,
+        api,
+        user: {
+          id: me.id ?? creds.id ?? null,
+          email: me.email ?? creds.email ?? null,
+          name: me.name ?? null,
+          credits: me.credits ?? null,
+        },
+      });
+    } else {
+      console.log(`${me.email || me.name || "moshcoder"} 🤘  (${me.credits ?? "?"} credits)  @ ${api}`);
+    }
   } catch {
-    console.log(`${creds.email || "logged in"} @ ${creds.api || API()} (couldn't reach the app to verify)`);
+    if (json) {
+      printJson({
+        status: "unreachable",
+        verified: false,
+        api,
+        user: localUser,
+        error: { type: "network" },
+      });
+    } else {
+      console.log(`${creds.email || "logged in"} @ ${api} (couldn't reach the app to verify)`);
+    }
   }
 }
 

package/src/cli-schema.mjs

@@ -161,7 +161,9 @@ export const CORE_CLI_COMMANDS = [
     name: "whoami",
     group: "account",
     description: "show the logged-in account",
-    synopsis: [["moshcode whoami", ""]],
+    synopsis: [["moshcode whoami [--json]", ""]],
+    flags: [["--json", "print account status as machine-readable JSON", ""]],
+    examples: [["moshcode whoami --json", "inspect the current session from a script"]],
     seeAlso: ["login", "logout"],
   },
   {

package/src/completion.mjs

@@ -215,7 +215,7 @@ Register-ArgumentCompleter -Native -CommandName moshcode -ScriptBlock {
         }
       }
       'login' { if ($wordToComplete.StartsWith('-')) { $choices = $script:MoshcodeCompletionLogin } }
-      { $_ -in @('engines', 'tools', 'commands') } {
+      { $_ -in @('whoami', 'engines', 'tools', 'commands') } {
         if ($wordToComplete.StartsWith('-')) { $choices = $script:MoshcodeCompletionJson }
       }
       'run' { if ($wordToComplete.StartsWith('-')) { $choices = $script:MoshcodeCompletionRun } }
@@ -321,7 +321,7 @@ _moshcode_completion() {
       login)
         [[ "$cur" == -* ]] && choices="--browser -b --device -d"
         ;;
-      engines|tools|commands)
+      whoami|engines|tools|commands)
         [[ "$cur" == -* ]] && choices="--json"
         ;;
       run)
@@ -464,7 +464,7 @@ _moshcode() {
     login)
       _values "login option" --browser -b --device -d
       ;;
-    engines|tools|commands)
+    whoami|engines|tools|commands)
       _values "option" --json
       ;;
     run)
@@ -556,7 +556,7 @@ complete -c moshcode -n '__moshcode_nested_is mcp list' -l json -d 'print JSON'
 complete -c moshcode -n '__moshcode_nested_is skill list; or __moshcode_nested_is skills list' -l json -d 'print JSON'
 complete -c moshcode -n '__moshcode_command_is login' -l browser -s b -d 'use browser authentication'
 complete -c moshcode -n '__moshcode_command_is login' -l device -s d -d 'use device-code authentication'
-complete -c moshcode -n '${atSecondToken("agents engines tools commands")}' -l json -d 'print JSON'
+complete -c moshcode -n '${atSecondToken("agents whoami engines tools commands")}' -l json -d 'print JSON'
 complete -c moshcode -n '__moshcode_command_is run' -l dry-run -d 'show actions without executing'
 complete -c moshcode -n '__moshcode_command_is run' -l max -s n -r -d 'maximum loop count'
 complete -c moshcode -n '__moshcode_command_is uninstall remove' -l yes -s y -d 'confirm deleting a binary'

package/src/engines.mjs

@@ -5,11 +5,11 @@
 //
 // `agentsView` (optional) is the exact argv that opens the engine's native
 // agent list/view — used by `/agents <name>` when the engine actually has one
-// (claude, opencode). It's the FULL leading args (subcommand + any flags that
-// subcommand accepts), because not every agents-subcommand takes the engine's
-// bypass flag (e.g. `opencode agent list` takes none). Engines without an
-// `agentsView` fall back to `agentArgs` — an autonomous session with native
-// approvals bypassed/auto-approved.
+// (currently claude). It's the FULL leading args (subcommand + any flags that
+// subcommand accepts). Engines without an `agentsView` fall back to
+// `agentArgs` — an autonomous session with native approvals
+// bypassed/auto-approved. Do not use a machine-readable, one-shot list command
+// as an agents view: `/agents` promises to hand the terminal to a live session.
 import { spawn } from "node:child_process";
 import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
@@ -22,17 +22,19 @@ export const ENGINES = {
     desc: "opencode — the open-source coding agent (SST/anomalyco)",
     bin: "opencode",
     agentArgs: ["--auto"],
-    agentsView: ["agent", "list"], // `opencode agent list` — lists agents; the `agent` subcommand takes no bypass flag
     install: { cmd: "bash", args: ["-c", "curl -fsSL https://opencode.ai/install | bash"] },
     upgrade: { cmd: "opencode", args: ["upgrade"] },
+    // The installer appends this directory to a shell profile. The moshcode
+    // process that ran it cannot see that PATH change, so search it directly.
+    binDirs: [path.join(homedir(), ".opencode", "bin")],
   },
   privacycode: {
     desc: "privacycode — privacy-first coding agent (profullstack)",
     bin: "privacycode",
     // An opencode derivative, so it speaks the same flags/subcommands.
     agentArgs: ["--auto"],
-    agentsView: ["agent", "list"],
     install: { cmd: "sh", args: ["-c", "curl -fsSL https://getprivacycode.com/install | sh"] },
+    binDirs: [path.join(homedir(), ".privacycode", "bin")],
     // Deliberately no native updater. `privacycode upgrade` is opencode's, and
     // it works out how to update itself by recognising where it was installed —
     // it knows opencode's own locations, not this fork's ~/.privacycode/bin. It
@@ -263,9 +265,10 @@ export function pickAiEngine(preferred) {
 
 /** Engine entries annotated with install status. */
 export function engineStatus() {
-  // Search each engine's own install dir as well as PATH — kimi's installer only
-  // adds ~/.kimi-code/bin to your shell rc, so PATH alone reports it missing in
-  // the very session that installed it. (Inert for engines without binDirs.)
+  // Search each engine's own install dir as well as PATH — several curl-based
+  // installers only add their bin directory to a shell rc, so PATH alone
+  // reports them missing in the very session that installed them. (Inert for
+  // engines without binDirs.)
   return Object.entries(ENGINES).map(([key, e]) => ({ key, ...e, installed: isInstalled(e.bin, e.binDirs) }));
 }
 

package/src/tui.mjs

@@ -539,7 +539,14 @@ export async function tui() {
       catch (e) { console.log(err(String(e.message || e))); }
       continue;
     }
-    if (cmd === "whoami") { await whoami(); continue; }
+    if (cmd === "whoami") {
+      if (rest.length > 1 || (rest.length === 1 && rest[0] !== "--json")) {
+        console.log(err("usage: /whoami [--json]"));
+        continue;
+      }
+      await whoami({ json: rest[0] === "--json" });
+      continue;
+    }
     if (cmd === "logout") { logout(); continue; }
     if (cmd === "run") {
       await runFile(rest);