moshcode 0.25.1 → 0.26.0

package/.claude-plugin/marketplace.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "moshcode",
+  "description": "moshcode's own Claude Code plugins — the pit's slash commands, in your engine",
+  "owner": {
+    "name": "moshcoder",
+    "url": "https://moshcode.sh"
+  },
+  "plugins": [
+    {
+      "name": "ticker",
+      "description": "Equity research slash commands backed by advis0r.com: scored reports, extracted signals, transcript search, company-name lookup, and ranked watchlists.",
+      "source": "./plugins/ticker",
+      "category": "productivity",
+      "author": {
+        "name": "moshcoder",
+        "url": "https://moshcode.sh"
+      },
+      "homepage": "https://github.com/moshcoder/moshcode#ticker",
+      "keywords": ["stocks", "equity", "research", "markets", "advis0r"]
+    }
+  ]
+}

package/README.md

@@ -46,6 +46,8 @@ or miss one that does. A test fails the build when it drifts.
 | `moshcode engines` | engines | list engines and installation status |
 | `moshcode tools` | tools | list workflow tools and installation status |
 | `moshcode trade` | tools | look up markets and trade through Alpaca |
+| `moshcode ticker` <br>`advisor` | tools | equity research from advis0r.com |
+| `moshcode plugin` <br>`plugins` | extend | install moshcode's slash commands into Claude Code |
 | `moshcode commands` | script | list built-in moshscript commands |
 | `moshcode completion` | extend | print a shell completion script |
 | `moshcode run` | script | run a moshscript |
@@ -211,6 +213,49 @@ Alpaca's CLI has no confirmation prompts; `--submit` intentionally removes
 MoshCode's preview guard. Live trading additionally requires Alpaca's `--live`
 opt-in or corresponding environment setting.
 
+### Equity research (`moshcode ticker`)
+
+Where `trade` is Alpaca's order book, `ticker` is the research desk:
+[advis0r.com](https://advis0r.com/api)'s public read-only API, rendered in the
+pit. No key, no login, no write routes, no binary to install:
+
+```sh
+moshcode ticker NVDA               # score, technicals, fundamentals, thesis, signals
+moshcode ticker lookup rivian      # company name → RIVN
+moshcode ticker signals AAPL       # what was said, quoted and sourced
+moshcode ticker search "data center"  # across every indexed transcript
+moshcode ticker reports --limit 10 # the stored index, best score first
+moshcode ticker discover fusion    # a ranked watchlist (slow — analyzes each candidate)
+moshcode ticker open NVDA          # the shareable report page
+```
+
+Add `--json` to any of them for the raw response. The same facade is `/ticker …`
+in the pit, and `MOSHCODE_ADVISOR_URL` points it at another instance.
+
+Reports are **stored snapshots**, not live quotes: every response carries
+`reportGeneratedAt` and every renderer prints it, alongside whether the price is
+delayed and which feed produced it. Scores labelled `offline` come from
+deterministic rules rather than a model. It is a research aid, not advice, and
+nothing under `ticker` can place an order.
+
+### Social posting from the pit
+
+The pit can hand a prepared post to Bluesky or Nostr without storing either
+account's credentials in MoshCode:
+
+```text
+/socials
+/post bsky "shipped it 🤘"
+/post nostr "shipped it 🤘"
+```
+
+Bluesky opens its official compose intent. Nostr opens the MoshCode composer,
+connects to a NIP-07 browser signer (or a NIP-46 bunker through
+[`window.nostr.js`](https://github.com/fiatjaf/window.nostr.js)), signs a kind-1
+event, and publishes it to the displayed relays. Both flows leave the final
+confirmation in the browser. If the pit is remote or headless, `/post` prints
+the composer URL instead.
+
 ## Browser terminal (`moshcode console`)
 
 A real terminal in the browser — arrow keys, history, full-screen TUIs — because
@@ -287,6 +332,34 @@ from and five to rotate. Porkbun's API access is off by default and enabled
 per-domain — and its documentation tools work with no keys at all, which is a
 sensible way to try the server before trusting it with DNS writes.
 
+## Claude Code plugins
+
+MoshCode publishes its own plugin marketplace, so the pit's slash commands work
+inside your engine too:
+
+```sh
+moshcode plugin list              # what the marketplace ships, and who can take it
+moshcode plugin install           # add the marketplace + install `ticker`
+moshcode plugin remove ticker     # take it back off
+```
+
+`ticker@moshcode` adds `/ticker`, `/signals`, `/research`, `/lookup`,
+`/reports`, and `/discover` — the same advis0r research surface described above,
+driven from inside a coding session. Restart the engine afterwards; a newly
+installed plugin is not live in a session that is already running.
+
+The equivalent by hand:
+
+```sh
+claude plugin marketplace add moshcoder/moshcode
+claude plugin install ticker@moshcode
+```
+
+Claude Code is currently the only engine with a plugin primitive. The others are
+reported as skipped with a reason, the same way they are for skills, rather than
+being left out of the summary. `MOSHCODE_PLUGIN_SOURCE=.` installs from a local
+checkout instead of GitHub, which is how you try an unreleased plugin.
+
 ## Upgrade everything
 
 ```sh

package/bin/moshcode.mjs

@@ -19,7 +19,9 @@ import { tradeArgs, tradeUsage } from "../src/trade.mjs";
 import { runUpgrade } from "../src/upgrade.mjs";
 import { selfUpdateCommand } from "../src/selfupdate.mjs";
 import { describeUninstall, uninstallPlan } from "../src/uninstall.mjs";
-import { mcpCommand, skillCommand } from "../src/integrations.mjs";
+import { mcpCommand, pluginCommand, skillCommand } from "../src/integrations.mjs";
+import { tickerCommand } from "../src/advisor.mjs";
+import { canOpenBrowser, openBrowser } from "../src/open-url.mjs";
 import { locate, tilde } from "../src/pwd.mjs";
 import { createPrd, listPrds, authoringPrompt } from "../src/prd.mjs";
 import { loginAuto, whoami, logout } from "../src/auth.mjs";
@@ -344,6 +346,18 @@ async function main() {
     propagateExit(r.code, r.signal);
     return;
   }
+  if (cmd === "ticker" || cmd === "advisor") {
+    const code = await tickerCommand(rest, {
+      openUrl: (url) => canOpenBrowser() && openBrowser(url),
+    });
+    if (code) process.exitCode = code;
+    return;
+  }
+  if (cmd === "plugin" || cmd === "plugins") {
+    const code = await pluginCommand(rest);
+    if (code) process.exitCode = code;
+    return;
+  }
   if (cmd === "console") {
     const code = await consoleCommand(rest);
     if (code) process.exitCode = code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "type": "module",
   "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {
@@ -25,6 +25,8 @@
     "src",
     "examples",
     "prd",
+    ".claude-plugin",
+    "plugins",
     "install.sh",
     "README.md"
   ],

package/plugins/ticker/.claude-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
+  "name": "ticker",
+  "description": "Equity research slash commands backed by advis0r.com: scored reports, extracted signals, transcript search, company-name lookup, and ranked watchlists.",
+  "version": "0.1.0",
+  "author": {
+    "name": "moshcoder",
+    "url": "https://moshcode.sh"
+  },
+  "homepage": "https://github.com/moshcoder/moshcode#ticker",
+  "license": "MIT",
+  "keywords": ["stocks", "equity", "research", "markets", "advis0r"]
+}

package/plugins/ticker/README.md

@@ -0,0 +1,49 @@
+# ticker — equity research in your engine 🤘
+
+Slash commands backed by [advis0r.com](https://advis0r.com/api): scored research
+reports, extracted signals with sources, transcript search, company-name lookup,
+and ranked watchlists.
+
+| command | what it does |
+| --- | --- |
+| `/ticker NVDA` | score, technicals, fundamentals, thesis, signals, sources |
+| `/signals AAPL` | what was actually said, quoted and sourced |
+| `/research data center` | full-text search across every indexed transcript |
+| `/lookup rivian` | company name → `RIVN` |
+| `/reports` | every stored report, best score first |
+| `/discover fusion` | a ranked watchlist for a topic (slow) |
+
+## Install
+
+```bash
+moshcode plugin install
+```
+
+Or straight from Claude Code:
+
+```bash
+claude plugin marketplace add moshcoder/moshcode
+claude plugin install ticker@moshcode
+```
+
+Restart the engine afterwards — a newly installed plugin is not live in a
+session that is already running.
+
+## How it works
+
+Each command shells out to `moshcode ticker …`, which calls advis0r's public,
+read-only API. No key, no login, no write routes. With `moshcode` absent, every
+command falls back to `curl` against the same endpoints.
+
+Point the commands at another instance with `MOSHCODE_ADVISOR_URL`.
+
+## What this is not
+
+A research aid, not advice. Reports are **stored snapshots** — every response
+carries `reportGeneratedAt`, and every command is instructed to print it, because
+a stale price presented as a live one is the one failure mode that actually costs
+someone money. Scores marked `offline` come from deterministic rules, not a model.
+
+Trading lives behind a different verb: `moshcode trade` wraps Alpaca, previews
+orders by default, and requires an explicit `--submit`. Nothing in this plugin
+can place an order.

package/plugins/ticker/commands/discover.md

@@ -0,0 +1,37 @@
+---
+description: Build a ranked watchlist for a topic (slow — it analyzes each candidate).
+argument-hint: "[topic]"
+allowed-tools: Bash(moshcode ticker:*), Bash(curl -sS https://advis0r.com/api/:*)
+---
+
+## Task
+
+Rank candidates for `$ARGUMENTS` (no topic → the default watchlist).
+
+```bash
+moshcode ticker discover $ARGUMENTS --limit 10 --json
+```
+
+Fallback: `curl -sS --max-time 180 "https://advis0r.com/api/discover?topic=<url-encoded>&provider=offline&horizon=2&limit=10"`
+
+**This route runs an analysis per candidate and can take minutes.** Tell the
+user it is working before you start, and do not retry on a timeout — re-running
+it costs the same minutes again.
+
+## Reading the response
+
+`candidates` is ranked, each with `rank`, `ticker`, `companyName`, `lastPrice`,
+`overallScore`, `confidence`, `classification`, `thesis`, `primaryCatalyst`,
+`mainRisk`, `independentConfirmation`, plus liquidity fields
+(`bidAskSpreadPercent`, `avgVolume`, `float`, `marketCap`).
+
+## Rules
+
+- Lead with `rank`, `ticker`, `overallScore`, and `classification`.
+- **Print `mainRisk` next to every thesis.** A ranked list that shows only the
+  bull case is a pitch, not research.
+- `provider: offline` means these scores are deterministic rules, not a model.
+  Say which provider produced the ranking.
+- Flag illiquidity: a wide `bidAskSpreadPercent` or thin `avgVolume` matters
+  more than the score for anything small-cap.
+- End with the response's own `disclaimer`.

package/plugins/ticker/commands/lookup.md

@@ -0,0 +1,27 @@
+---
+description: Find a ticker symbol by company name (rivian → RIVN).
+argument-hint: <company name>
+allowed-tools: Bash(moshcode ticker:*), Bash(curl -sS https://advis0r.com/api/:*)
+---
+
+## Task
+
+Resolve `$ARGUMENTS` to a ticker symbol.
+
+```bash
+moshcode ticker lookup $ARGUMENTS --limit 10 --json
+```
+
+Fallback: `curl -sS "https://advis0r.com/api/lookup?q=<url-encoded>&limit=10"`
+
+## Reading the response
+
+`matches` is a list of `{ symbol, name, exchange, hasReport }`.
+`hasReport: true` means advis0r already has a stored research snapshot.
+
+## Rules
+
+- Show every match with its exchange — "Delta" is an airline and a faucet company.
+- Mark which ones have a report, and offer `/ticker <SYMBOL>` for those.
+- One unambiguous match: say the symbol and go straight to offering the report.
+- No match: say the *directory* has no match, and do not invent a symbol.

package/plugins/ticker/commands/reports.md

@@ -0,0 +1,30 @@
+---
+description: Every stored advis0r research report, best score first.
+argument-hint: "[--limit n] [--sort recent|score|ticker]"
+allowed-tools: Bash(moshcode ticker:*), Bash(curl -sS https://advis0r.com/api/:*)
+---
+
+## Task
+
+List the stored reports.
+
+```bash
+moshcode ticker reports $ARGUMENTS --json
+```
+
+Fallback: `curl -sS "https://advis0r.com/api/reports?sort=score&limit=25"`
+
+## Reading the response
+
+`reports` is a list of `{ ticker, companyName, lastPrice, overallScore,
+confidence, classification, aiProvider, aiModel, sourceCount, signalCount,
+generatedAt }`, and `total` is how many exist.
+
+## Rules
+
+- Render as a table: ticker, score, classification, price, generated-at.
+- **`generatedAt` per row, always.** These are snapshots taken at different
+  times; a table that hides that reads as one consistent as-of date.
+- A row with no `aiProvider` was scored deterministically, not by a model.
+- Offer `/ticker <SYMBOL>` for anything worth a closer look.
+- This is a coverage list, not a recommendation list. Rank order is score order.

package/plugins/ticker/commands/research.md

@@ -0,0 +1,29 @@
+---
+description: Full-text search across every indexed earnings transcript and article.
+argument-hint: <words to search for>
+allowed-tools: Bash(moshcode ticker:*), Bash(curl -sS https://advis0r.com/api/:*)
+---
+
+## Task
+
+Search the transcript index for `$ARGUMENTS`.
+
+```bash
+moshcode ticker search $ARGUMENTS --limit 20 --json
+```
+
+Fallback: `curl -sS "https://advis0r.com/api/search?q=<url-encoded>&limit=20"`
+
+## Reading the response
+
+`results` is a list of segments: `text`, `speaker`, `ticker`, `event_date`.
+The API tries full-text search first and falls back to a substring scan, so a
+hit is a hit — but relevance is not ranked. Read before summarizing.
+
+## Rules
+
+- Cluster the hits by ticker and say which companies came up, with dates.
+- Quote sparingly and attribute each quote to its speaker and ticker.
+- If nothing matches, say the *index* has no match — this searches advis0r's
+  indexed corpus, not the whole web. Suggest `/lookup` if the query looks like
+  a company name.

package/plugins/ticker/commands/signals.md

@@ -0,0 +1,30 @@
+---
+description: What was actually said about a ticker — extracted signals with quotes and sources.
+argument-hint: <SYMBOL>
+allowed-tools: Bash(moshcode ticker:*), Bash(curl -sS https://advis0r.com/api/:*)
+---
+
+## Task
+
+List the extracted signals for `$ARGUMENTS`.
+
+```bash
+moshcode ticker signals $ARGUMENTS --json
+```
+
+Fallback: `curl -sS "https://advis0r.com/api/signals?ticker=$ARGUMENTS"`
+
+## Reading the response
+
+Each signal carries `signal_type`, `direction` (positive/negative/neutral),
+`strength`, `specificity`, `quote`, `event_date`, `speaker`, `speaker_title`,
+`source_url`, and `source_tier`.
+
+## Rules
+
+- Group by direction and lead with the most recent. Note the positive/negative split.
+- **Every claim keeps its `source_url`.** These are extracted quotes from
+  transcripts and articles — a signal repeated without its source is a rumor.
+- `strength` and `specificity` are the extractor's confidence, not the market's.
+  A strong signal from a low `source_tier` is still a low-tier source; say so.
+- End with the response's own `disclaimer`.

package/plugins/ticker/commands/ticker.md

@@ -0,0 +1,42 @@
+---
+description: Research one ticker — score, technicals, fundamentals, thesis, signals, and sources.
+argument-hint: <SYMBOL>
+allowed-tools: Bash(moshcode ticker:*), Bash(curl -sS https://advis0r.com/api/:*)
+---
+
+## Task
+
+Pull the stored research report for `$ARGUMENTS` and summarize it for the user.
+
+Run:
+
+```bash
+moshcode ticker $ARGUMENTS --json
+```
+
+If `moshcode` is not installed, fall back to the API directly:
+
+```bash
+curl -sS "https://advis0r.com/api/ticker?symbol=$ARGUMENTS"
+```
+
+## Reading the response
+
+- `overallScore` (0–100), `confidence`, and `classification` are the headline. A
+  low score is a *finding*, not a failure to report.
+- `aiAnalysis.analysis.thesis` is a hosted-model take; `analysis.thesis` is a
+  deterministic offline one. Say which you are quoting — they carry different weight.
+- `technical` holds rsi14 / sma / macd / atr / relativeVolume.
+- `facts` holds SEC fundamentals; `facts.source === "unavailable"` means the
+  fundamentals section is missing, not that the company has none.
+- `signals` are extracted quotes with `direction` and `source_url`.
+- `sources` are the documents behind them.
+
+## Rules
+
+- **`reportGeneratedAt` is when this snapshot was built.** State it. The price in
+  a stored report is not a live quote, and must never be presented as one.
+- If the response is a 400 with `didYouMean`, the user typed a company name
+  rather than a symbol — re-run against the suggested symbol and say you did.
+- End with the response's own `disclaimer`. This is research, not advice.
+- Link the shareable report: `https://advis0r.com/ticker/<SYMBOL>`.

package/prd/0008-ticker-research-and-plugin-marketplace.md

@@ -0,0 +1,130 @@
+---
+openprd: "0.2"
+id: "0008"
+title: "Bring equity research into the pit, and ship the pit's slash commands as a plugin"
+status: Draft
+authors:
+  - anthony@profullstack.com
+created: 2026-08-06
+updated: 2026-08-06
+repo: https://github.com/moshcoder/moshcode
+discussion:
+implementation:
+tags:
+  - research
+  - plugins
+  - advis0r
+supersedes:
+superseded-by:
+---
+
+## Problem
+
+`moshcode trade` can look up a quote and place an order. It cannot answer the
+question that comes before either one — *is this worth buying?* Everything that
+would inform that lives in [advis0r.com](https://advis0r.com/api): indexed
+earnings transcripts and news, extracted signals with sources, SEC fundamentals,
+technicals, and a composite score. Today that means leaving the pit for a
+browser, and it means an agent working in a session has no path to it at all.
+
+Two separate gaps, one cause:
+
+1. **In the pit.** There is no research verb. `/trade quote AAPL` returns a
+   price and nothing about why it is that price.
+2. **In the engine.** moshcode already fans MCP servers and Agent Skills out
+   across engines, but it publishes no commands of its own. A slash command that
+   exists at the mosh prompt does not exist inside Claude Code, and there is no
+   mechanism by which it could.
+
+## Goals
+
+- Research a ticker without leaving the terminal, in one short command.
+- An agent mid-session can pull sourced evidence about a company rather than
+  recalling it from training data.
+- moshcode's own slash commands become installable into the engines it drives,
+  through the engines' native plugin mechanism rather than a moshcode-specific one.
+- A stored snapshot is never mistaken for a live quote.
+
+## Non-Goals
+
+- Placing orders. `trade` owns that, with its preview-by-default guard; nothing
+  under `ticker` writes anything anywhere.
+- Reimplementing advis0r. Every route used is public, read-only, and unauthenticated;
+  scoring, ingestion, and analysis stay server-side.
+- Authentication. The routes that need a sign-in (`/api/digest`,
+  `/api/report/regenerate`) are deliberately out of scope — adding credentials
+  would make this the first moshcode verb that holds one.
+- A general plugin framework. One marketplace, one plugin, extended by adding a
+  directory.
+
+## Users
+
+- Someone in the pit deciding what to look at before opening the trading CLI.
+- A coding agent asked about a company, which should cite indexed sources rather
+  than assert from memory.
+
+## Requirements
+
+- R1 [P0] `moshcode ticker <SYMBOL>` prints the stored report: score, confidence,
+  classification, technicals, fundamentals, thesis, recent signals, and sources.
+- R2 [P0] Verbs for the rest of the surface: `signals`, `search`, `lookup`,
+  `reports`, `discover`, `tickers`, `stats`, `open`. A first argument that is not
+  a verb is a symbol; `report` is the unambiguous spelling for a symbol that
+  collides with one.
+- R3 [P0] Every rendered report states `reportGeneratedAt`, whether the price is
+  delayed, and which feed produced it. A stored price must never render as a live one.
+- R4 [P0] Every substantive response carries the API's own `disclaimer` through
+  to the output.
+- R5 [P0] `--json` on any verb prints the raw response, so scripts and agents get
+  the full document rather than the rendered subset.
+- R6 [P0] The same surface is `/ticker …` at the mosh prompt.
+- R7 [P1] A non-symbol argument is refused with the `lookup` that resolves it,
+  and a 400 carrying `didYouMean` surfaces the suggestion.
+- R8 [P0] `.claude-plugin/marketplace.json` publishes a `ticker` plugin providing
+  `/ticker`, `/signals`, `/research`, `/lookup`, `/reports`, `/discover`.
+- R9 [P0] `moshcode plugin install` adds the marketplace and installs the plugin,
+  fanning out across engines and reporting every engine without a plugin
+  primitive as skipped — the same contract as 0003 R8 for skills.
+- R10 [P1] `MOSHCODE_ADVISOR_URL` and `MOSHCODE_PLUGIN_SOURCE` redirect the API
+  and the marketplace, so both are testable against a checkout.
+- R11 [P1] The verb table in the schema and the parser's own list are checked
+  against each other, so a verb cannot complete and then fail.
+
+## UX Notes
+
+`ticker` renders in-process rather than handing the terminal to a tool, because
+unlike every other entry in `tools`, there is no advis0r binary — only an HTTP
+API. That makes it the first moshcode verb that formats a remote response itself,
+so the rendering rules matter more than usual:
+
+- Direction is colour: acid for positive signals, red for negative.
+- A model-written thesis is labelled with its provider and model; a
+  deterministic one is labelled `offline`. They carry different weight and must
+  not look alike.
+- Optional sections (fundamentals, technicals, analysis) are genuinely absent
+  when SEC or the market feed rate-limits. A missing section degrades the report;
+  it never prevents one.
+- `discover` ranks by analyzing each candidate and legitimately takes minutes. It
+  gets a longer timeout than the row-read routes, and says so up front.
+
+## Success Metrics
+
+- `/ticker <SYMBOL>` answers in one line of input, with sources.
+- The plugin installs into Claude Code and its six commands appear, verified by
+  `claude plugin validate` and an end-to-end install.
+- No rendered output anywhere presents a stored price as a live quote.
+
+## Risks & Open Questions
+
+- **Scored equity research one verb away from an order-placing CLI.** The
+  mitigation is structural rather than advisory: `ticker` has no write path,
+  `trade` keeps its preview guard, and the disclaimer travels with the data.
+- **Snapshot staleness.** advis0r rebuilds a report when it is missing or when a
+  watchlist member asks; moshcode cannot trigger a rebuild without
+  authentication. Printing the generated-at stamp is the honest answer, not a
+  workaround.
+- Single upstream: if advis0r is down, the verb is down. Acceptable — it is a
+  research aid, not a dependency of anything else in moshcode.
+- Open: whether `plugin` should later fan out to other engines as they gain
+  plugin primitives, or stay Claude-specific. The plan structure already allows
+  the first without a rewrite.

package/prd/README.md

@@ -23,4 +23,5 @@ Start one with `moshcode prd "<idea>"` (TUI: `/prd`).
 | [0005](0005-hosted-moshpit-resolver.md) | A hosted Moshpit resolver, for the devices that cannot run the bridge | Draft |
 | [0006](0006-help.md) | --help | Draft |
 | [0007](0007-profullstack-site-init.md) | Generate batteries-included Profullstack sites for Moshpit names | Draft |
+| [0008](0008-ticker-research-and-plugin-marketplace.md) | Bring equity research into the pit, and ship the pit's slash commands as a plugin | Draft |
 <!-- PRD-INDEX:END -->