moshcode 0.50.0 → 0.52.0

package/README.md

@@ -433,6 +433,7 @@ moshcode install doppler          # official script, installed user-local (needs
 moshcode install doctl            # GitHub release binary → ~/.local/bin
 moshcode install turso            # official script → ~/.turso (new shell to pick up PATH)
 moshcode install tailscale        # official script; system daemon, so it needs root
+moshcode install coral            # official script → ~/.local/bin (checksum-verified)
 
 moshcode gh pr list               # straight through to the native CLI
 moshcode railway up
@@ -1034,7 +1035,7 @@ chmod +x deploy.mosh
 | `ask(prompt)` | blocking gate — waits for human reply at moshcode.sh |
 | `say("…")` | print a line |
 | `sleep(ms)` | pause for N milliseconds (blocking) |
-| `shell(cmd)` | run a shell command (blocking, `$SHELL -c`); returns `{ ok, code }` |
+| `shell(cmd)` | run a shell command (blocking, `$SHELL -ic`, so your rc file loads); returns `{ ok, code }` |
 | `stop()` | end the loop (`alive = false`) |
 | `repeat()` | back to the top of the loop |
 
@@ -1061,6 +1062,7 @@ chmod +x deploy.mosh
 | `doctl(args…)` | drive the DigitalOcean CLI |
 | `turso(args…)` | drive the Turso CLI |
 | `tailscale(args…)` | drive the Tailscale CLI |
+| `coral(args…)` | drive the Coral CLI (SQL over APIs, databases, internal systems) |
 | `pwd()` | print the current repo/location |
 | `run(file)` | run another .mosh file (include/compose) |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "type": "module",
   "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {

package/src/advisor.mjs

@@ -8,7 +8,7 @@
 // The API is documented at https://advis0r.com/api and returns *stored*
 // snapshots: a report carries `reportGeneratedAt`, and every renderer prints it.
 // A stale price is fine; a stale price dressed up as a live one is not.
-import { acid, ash, amber, bone, danger, dim } from "./ui.mjs";
+import { acid, ash, amber, bone, clip, danger, dim } from "./ui.mjs";
 
 export const DEFAULT_ADVISOR_URL = "https://advis0r.com";
 
@@ -297,11 +297,6 @@ function compact(v) {
 
 const day = (v) => (v ? String(v).slice(0, 10) : "—");
 
-function clip(text, width) {
-  const s = String(text ?? "").replace(/\s+/g, " ").trim();
-  return s.length <= width ? s : `${s.slice(0, Math.max(1, width - 1))}…`;
-}
-
 /** Direction → color, so a wall of signals is skimmable. */
 function tone(direction) {
   if (direction === "positive") return acid;

package/src/aliases.mjs

@@ -8,7 +8,7 @@
 // An alias is a name and a line. The line is a shell command unless it starts
 // with `/`, in which case it is a pit command:
 //
-//   /alias set gs "git status"       → /gs   runs `$SHELL -c "git status"`
+//   /alias set gs "git status"       → /gs   runs `$SHELL -ic "git status"`
 //   /alias set cc "/agents claude"   → /cc   opens claude autonomously
 //
 // Shell-by-default because that is what the prompt is mostly asked for, and the
@@ -148,7 +148,7 @@ export function removeAlias(name) {
  *
  * Appended rather than substituted, the way a shell alias behaves: `/gs -sb` is
  * `git status -sb`. `args` is the raw remainder of the typed line, not the
- * tokenized parts, so the user's own quoting survives into `$SHELL -c`.
+ * tokenized parts, so the user's own quoting survives into `$SHELL -ic`.
  *
  * The `!` is what routes a bare value to the shell — the pit already reads a
  * leading `!` as "run this in $SHELL", so an alias does not need a second path

package/src/commands.mjs

@@ -20,6 +20,7 @@ import { cliVerb, aiVerb } from "./cli.mjs";
 import { ingestApproval, pollApproval } from "./notify.mjs";
 import { capture, killSession, sendPrompt } from "./herd.mjs";
 import { herdStart, roster, waitFor } from "./herd-cli.mjs";
+import { shellInvocation } from "./shell.mjs";
 
 // The moshcoding pit-anthem playlist. mosh() blasts this URL and, on a desktop
 // with a GUI, tries to open it in the default browser.
@@ -190,9 +191,9 @@ const COMMANDS = [
 
   {
     name: "shell",
-    summary: "run a shell command (blocking, cmd.exe on Windows or $SHELL -c elsewhere)",
+    summary: "run a shell command (blocking, cmd.exe on Windows or $SHELL elsewhere)",
     usage: "shell(cmd)",
-    detail: "runs cmd in $SHELL; returns { ok, code, signal }",
+    detail: "runs cmd in $SHELL, loading your rc file where it can; returns { ok, code, signal }",
     // The moshscript system verb for arbitrary shell commands. Blocking
     // (spawnSync + inherited stdio) so it runs inline in the no-`await` style,
     // and the child owns the terminal for interactive commands. Returns
@@ -202,15 +203,16 @@ const COMMANDS = [
       const cmd = args.join(" ");
       if (!cmd) throw new Error("moshscript: shell() requires a command string");
       if (ctx.dryRun) {
-        ctx.out(`  ▶ shell(${JSON.stringify(cmd)}) → would run: $SHELL -c ${JSON.stringify(cmd)}`);
+        ctx.out(`  ▶ shell(${JSON.stringify(cmd)}) → would run: $SHELL ${shellInvocation(cmd).flags} ${JSON.stringify(cmd)}`);
         // Same R8 contract as the comment above: `code` is always present, so a
         // script branching on the exit status behaves the same under --dry-run.
         return { ok: true, code: 0, dryRun: true };
       }
-      const sh = process.platform === "win32"
-        ? (process.env.COMSPEC || "cmd.exe")
-        : (process.env.SHELL || "/bin/sh");
-      const shArgs = process.platform === "win32" ? ["/d", "/s", "/c", cmd] : ["-c", cmd];
+      // Same invocation the pit's own `!cmd` uses, so a command that works when
+      // typed works when scripted: interactive where a terminal is attached, so
+      // the user's rc file — and the aliases in it — are loaded. src/shell.mjs
+      // has the reasoning, including why a headless run stays non-interactive.
+      const { shell: sh, args: shArgs } = shellInvocation(cmd);
       ctx.out(`  ▶ shell: ${cmd}`);
       const res = spawnSync(sh, shArgs, { stdio: "inherit" });
       if (res.error) throw res.error;
@@ -350,6 +352,7 @@ const COMMANDS = [
   cliVerb("doctl", "drive the DigitalOcean CLI (droplets, apps, databases)"),
   cliVerb("turso", "drive the Turso CLI (auth, databases, replicas)"),
   cliVerb("tailscale", "drive the Tailscale CLI (mesh VPN: up, status, ssh, serve)"),
+  cliVerb("coral", "drive the Coral CLI (SQL over APIs, databases, and internal systems)"),
   cliVerb("alpaca", "drive the native Alpaca trading CLI"),
   cliVerb("trade", "look up tickers, inspect markets, and preview/place Alpaca orders"),
   cliVerb("pwd", "print the current repo/location"),

package/src/crypto.mjs

@@ -13,7 +13,12 @@
 // Rendering them through one code path would mean one set of labels lying about
 // one of them.
 import { advisorBase } from "./advisor.mjs";
-import { acid, ash, amber, bone, danger, dim } from "./ui.mjs";
+import { acid, ash, amber, bone, clip, danger, dim, sparkline } from "./ui.mjs";
+
+// `spark` is this module's own command, so the renderer keeps its name in the
+// public surface even though the drawing now lives in ui.mjs with the rest of
+// the layout primitives.
+export { sparkline };
 
 const USAGE = `usage: moshcode crypto <pair|verb> [args…]
 
@@ -384,11 +389,6 @@ function stamp(v) {
 
 const day = (v) => (v ? String(v).slice(0, 10) : "—");
 
-function clip(text, width) {
-  const s = String(text ?? "").replace(/\s+/g, " ").trim();
-  return s.length <= width ? s : `${s.slice(0, Math.max(1, width - 1))}…`;
-}
-
 function wrapText(text, width) {
   const words = String(text).replace(/\s+/g, " ").trim().split(" ");
   const lines = [];
@@ -416,22 +416,6 @@ function scoreTone(score) {
   return danger;
 }
 
-const SPARK_TICKS = "▁▂▃▄▅▆▇█";
-
-/** Render a close series as one line of block characters. */
-export function sparkline(points) {
-  const values = (Array.isArray(points) ? points : []).map(Number).filter(Number.isFinite);
-  if (!values.length) return "";
-  const min = Math.min(...values);
-  const max = Math.max(...values);
-  // A flat series has no range to scale into; drawing it at the floor would
-  // imply a crash, so it sits mid-band instead.
-  if (max === min) return SPARK_TICKS[3].repeat(values.length);
-  return values
-    .map((v) => SPARK_TICKS[Math.min(SPARK_TICKS.length - 1, Math.floor(((v - min) / (max - min)) * SPARK_TICKS.length))])
-    .join("");
-}
-
 /**
  * The API ships a disclaimer with every substantive response. Printing it is
  * not decoration — this renders scored market analysis in a terminal next to a

package/src/games.mjs

@@ -11,7 +11,7 @@
 // a state, hand it a key, hand it a tick, ask it for rows — and everything that
 // touches a terminal lives in `runGame` down the bottom. That is what makes an
 // arcade testable: test/games.test.mjs plays entire games without a TTY.
-import { acid, amber, ash, bone, danger, dim, rgb } from "./ui.mjs";
+import { acid, amber, ash, bone, danger, dim, pad, rgb, strip, visible } from "./ui.mjs";
 import { TETRIS } from "./games-tetris.mjs";
 import { SNAKE } from "./games-snake.mjs";
 import { PACMAN } from "./games-pacman.mjs";
@@ -70,11 +70,9 @@ export function resolveGame(name) {
 
 // Colour codes are invisible but not zero-width to `.length`, so every pad in
 // here measures the stripped string. Getting this wrong is how a board's right
-// edge ends up ragged the moment someone wins.
-const ANSI = /\x1b\[[0-9;]*m/g;
-export const strip = (s) => String(s).replace(ANSI, "");
-export const visible = (s) => strip(s).length;
-const pad = (s, width) => s + " ".repeat(Math.max(0, width - visible(s)));
+// edge ends up ragged the moment someone wins. The games re-export these
+// because every one of them draws with them; the implementations are ui.mjs's.
+export { strip, visible };
 
 /**
  * The one frame every game is drawn in.

package/src/herd-cli.mjs

@@ -16,7 +16,7 @@ import {
 import { clearReport, reportState, STATES, withState } from "./herd-state.mjs";
 import { ENGINES, resolveEngine, resolveExecutable, agentLaunchArgs } from "./engines.mjs";
 import { ingestApproval, pollApproval } from "./notify.mjs";
-import { acid, amber, ash, bone, danger, dim, err, info, ok, warn } from "./ui.mjs";
+import { acid, amber, ash, bone, danger, dim, err, info, ok, table, warn } from "./ui.mjs";
 
 /** Distinct exit codes, because `wait` exists to be branched on (R10). */
 export const EXIT = { matched: 0, usage: 1, timeout: 2, gone: 3 };
@@ -78,21 +78,20 @@ export function paintState(state) {
  */
 export function renderRoster(rows, { indent = "  " } = {}) {
   if (!rows.length) return "";
-  const w = (key, min) => Math.max(min, ...rows.map((r) => String(r[key] ?? "").length));
-  const nameW = w("name", 4);
-  const engineW = w("engine", 6);
-  return rows.map((r) => [
-    indent,
-    bone(r.name.padEnd(nameW)),
-    "  ",
-    ash(String(r.engine).padEnd(engineW)),
-    "  ",
-    paintState(r.state).padEnd(9 + (paintState(r.state).length - r.state.length)),
-    "  ",
-    ash(tilde(r.cwd || "").padEnd(24)),
-    "  ",
-    dim(humanAge(r.age)),
-  ].join("")).join("\n");
+  // Cells go in painted and `table` measures what prints, which is what the
+  // state column needed: padding a coloured string to a fixed 9 used to mean
+  // hand-correcting the width by the length of its own escape codes, and the
+  // cwd column was pinned at 24 whether the paths were 8 columns or 60.
+  return table(
+    rows.map((r) => [
+      bone(r.name),
+      ash(String(r.engine)),
+      paintState(r.state),
+      ash(tilde(r.cwd || "")),
+      dim(humanAge(r.age)),
+    ]),
+    { columns: ["name", "engine", "state", "cwd", "age"], header: false, indent: indent.length },
+  );
 }
 
 /** Every session, with state attached. The one place that assembles both. */

package/src/news-sources.mjs

@@ -88,6 +88,86 @@ export function isDeadEndLink(url) {
   }
 }
 
+/**
+ * Words a quote page's title is padded with, and the corporate suffixes that
+ * are part of a company's legal name rather than part of a headline.
+ *
+ * Stripped before counting words, because what is left after they go is the
+ * company name — and a title that is only a company name is a label on a page,
+ * not a report of something that happened.
+ */
+const LABEL_WORDS = new RegExp(
+  "\\b(common|preferred|ordinary|class [a-c]|stock|stocks|shares?|share|price|prices|"
+  + "quote|quotes|chart|charts|charting|financials?|fundamentals?|overview|profile|"
+  + "summary|statistics|historical|data|dividends?|earnings|holdings?|ratings?|"
+  + "forecast|analysis|news|nasdaq|nyse|amex|otc|inc|incorporated|corp|corporation|"
+  + "ltd|limited|plc|llc|lp|co|company|group|holdings|sa|ag|nv|the|and|of)\\b\\.?",
+  "gi",
+);
+
+/**
+ * The reference-page paths, host-agnostic.
+ *
+ * Every finance site builds the same page — one URL per ticker, showing the
+ * current price and never going stale — and they nearly all spell it with one
+ * of these segments. Matching the path shape rather than a list of hostnames
+ * means a site nobody thought of is still recognised, and a site that changes
+ * its domain does not need a code change.
+ */
+const QUOTE_PATH = new RegExp(
+  "(^|/)(quote|quotes|symbol|symbols|tickers?|market-activity|market-data|"
+  + "investing/stock|investing/stocks|markets/companies|data/equities|"
+  + "stocks/charts|stock-price|price-quote)(/|$)",
+  "i",
+);
+
+/**
+ * Is this a standing reference page rather than a story?
+ *
+ * A news search for a ticker does not come back with only news. Measured on
+ * `LTRN`, four of Bing's nine results were the same kind of thing: nasdaq.com's
+ * insider-activity and advanced-charting tabs, marketwatch.com's financials
+ * tab, and seekingalpha.com/symbol/LTRN. None of them is an article. They are
+ * the permanent page a site keeps for a ticker, and they are worse than merely
+ * useless in a dated list, because the date attached to them is whenever the
+ * crawler last looked:
+ *
+ *   · Two of the four carried a 2020 date and sorted to the bottom as "75mo
+ *     ago", which reads as an old story rather than as a page with no date.
+ *   · marketwatch.com/investing/stock/ltrn/financials carried *yesterday's*
+ *     date and sorted to the very top, so the freshest-looking headline in the
+ *     list was a page that has not changed in years.
+ *
+ * Both signals are required, because either alone is wrong often enough to
+ * matter. A quote-shaped URL is not proof — publishers file real stories under
+ * `/quote/` — and a short title is not proof either, since "Lantern Pharma
+ * Halts Trial" is four words and is news. Demanding both means a story has to
+ * be filed at a reference URL *and* be titled like a label before it is
+ * dropped, and on the LTRN sample that is exactly the four pages and none of
+ * the five stories.
+ *
+ * Dropped rather than merely deranked, but never silently: collectNews returns
+ * the count so the listing can say how many it set aside.
+ */
+export function isReferencePage(url, title) {
+  let path;
+  try { path = new URL(String(url)).pathname; }
+  catch { return false; }
+  if (!QUOTE_PATH.test(path)) return false;
+
+  // The ticker in parentheses, then a bare all-caps ticker anywhere, then the
+  // boilerplate. Order matters: "(LTRN)" has to go before the bare-ticker rule
+  // sees it, or the parentheses are left behind as a word of their own.
+  const bare = String(title ?? "")
+    .replace(/\([^)]*\)/g, " ")
+    .replace(/\b[A-Z]{1,5}(?:\.[A-Z]{1,2})?\b/g, " ")
+    .replace(LABEL_WORDS, " ")
+    .replace(/[^a-z0-9]+/gi, " ")
+    .trim();
+  const words = bare ? bare.split(/\s+/).length : 0;
+  return words <= 3;
+}
+
 /** The vendored copy of what profullstack.com/feeds.opml serves. */
 const PROFULLSTACK_OPML = new URL("./profullstack-feeds.opml", import.meta.url);
 

package/src/news.mjs

@@ -28,6 +28,7 @@ import {
   defaultFeeds,
   FEED_LISTS,
   isDeadEndLink,
+  isReferencePage,
   resolveList,
   subscribableLists,
   unwrapRedirect,
@@ -644,7 +645,7 @@ export function parseFeed(xml, { url = "" } = {}) {
 
   const items = [];
   for (const block of blocks) {
-    const title = pick(block, "title");
+    const title = tidyTitle(pick(block, "title"));
     const link = linkOf(block, url);
     if (!title && !link) continue; // nothing to show and nothing to open
     items.push({
@@ -663,6 +664,22 @@ function clip(value, max) {
   return s.length > max ? `${s.slice(0, max - 1)}…` : s;
 }
 
+/**
+ * A title with someone else's truncation marker tidied up.
+ *
+ * Search engines cut long titles and mark the cut with a space and three dots.
+ * Left alone that trailing " ..." is a word like any other to a wrapper, so a
+ * headline that fills its last line exactly puts the dots on a line of their
+ * own — a row containing nothing but "...". Joining it to the word before it,
+ * as the single character it means, keeps it where the cut happened.
+ */
+export function tidyTitle(title) {
+  return String(title ?? "")
+    .replace(/\s*(\.\s*){3,}\s*$/, "…")
+    .replace(/\s+…$/, "…")
+    .trim();
+}
+
 // ---------------------------------------------------------------------------
 // Fetching
 // ---------------------------------------------------------------------------
@@ -766,6 +783,8 @@ export async function collectNews(feeds, { fetchImpl, timeoutMs = DEFAULT_TIMEOU
   const items = [];
   const failures = [];
   const seen = new Set();
+  const titles = new Set();
+  let skipped = 0;
   for (const result of results) {
     if (result.error) { failures.push({ name: result.feed.name, url: result.feed.url, error: result.error }); continue; }
     for (const item of result.parsed.items) {
@@ -778,17 +797,57 @@ export async function collectNews(feeds, { fetchImpl, timeoutMs = DEFAULT_TIMEOU
       // aggregator interstitials qualify; an item with no link at all is still
       // worth listing, because its title carries the news.
       if (link && isDeadEndLink(link)) continue;
+      // A ticker's standing quote page is not news, and its crawl date makes it
+      // sort as though it were. Counted rather than hidden — the listing says
+      // how many it set aside.
+      if (link && isReferencePage(link, item.title)) { skipped++; continue; }
       const key = link || `${result.feed.name}:${item.title}`;
       if (seen.has(key)) continue;
       seen.add(key);
-      items.push({ ...item, link, feed: result.feed.name, feedTitle: result.parsed.title || result.feed.title });
+      // The same title twice is one story, whichever URL carried it. Search
+      // engines return a publisher's own page and two syndications of it, and
+      // subscribed feeds overlap the same way; the first copy wins, and because
+      // this runs before the sort that is the first feed to answer rather than
+      // the newest. Only titles that survive normalisation to something
+      // substantial are deduped, so a feed of one-word entries is left alone.
+      const fingerprint = fingerprintTitle(item.title);
+      if (fingerprint) {
+        if (titles.has(fingerprint)) continue;
+        titles.add(fingerprint);
+      }
+      items.push({
+        ...item,
+        link,
+        feed: result.feed.name,
+        feedTitle: result.parsed.title || result.feed.title,
+        // Who published it, which is what a searcher needs and what the feed
+        // name cannot say: every result of a `/news search` comes from the one
+        // search feed, so a column of "bing" nine times over is a column that
+        // tells you nothing. Empty for an item with no link.
+        host: link ? hostOf(link) : "",
+      });
     }
   }
   // Newest first, and undated entries last rather than pretending they are old:
   // plenty of feeds omit dates entirely, and sorting them to the bottom keeps
   // them reachable without letting them claim the top of the list.
   items.sort((a, b) => (b.date ?? -Infinity) - (a.date ?? -Infinity));
-  return { items, failures };
+  return { items, failures, skipped };
+}
+
+/**
+ * A title reduced to what two copies of the same story would share.
+ *
+ * Case, punctuation and whitespace go, because syndication reflows all three.
+ * Returns "" for anything too short to be worth deduping on, so the caller can
+ * tell "no fingerprint" from "a fingerprint that happens to be empty".
+ */
+export function fingerprintTitle(title) {
+  const key = String(title ?? "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, " ")
+    .trim();
+  return key.length >= 12 ? key : "";
 }
 
 /**
@@ -959,37 +1018,124 @@ export function ago(ms, now = Date.now()) {
   if (days < 14) return `${days}d ago`;
   const weeks = Math.round(days / 7);
   if (weeks < 9) return `${weeks}w ago`;
-  return `${Math.round(days / 30)}mo ago`;
+  const months = Math.round(days / 30);
+  if (months < 24) return `${months}mo ago`;
+  // Past two years, months stop being a unit anyone reads. "75mo ago" is a
+  // number to divide before it means anything; "6y ago" is already the answer.
+  // Whole years only — at this distance the decimal is precision about
+  // something nobody is deciding anything on.
+  return `${Math.round(days / 365)}y ago`;
+}
+
+/**
+ * Break `text` into lines of at most `width`, on word boundaries where it can.
+ *
+ * A word longer than the width — which in practice means a URL — is split
+ * across lines rather than truncated. It has to be split somehow: left whole it
+ * wraps the terminal itself and every line below it lands one row low, which is
+ * the one failure that tears a whole frame. Splitting rather than cutting
+ * because the over-long word is usually the link, and half a link is not a link.
+ *
+ * `max` caps how many lines come back, for a caller laying out a fixed number
+ * of rows. The last line kept is clipped rather than simply dropped, so the cut
+ * announces itself instead of looking like the text ended there.
+ *
+ * Lives here rather than in rss-ui.mjs, which is where it was written and which
+ * still exports it, because the plain listing needs the same wrapping and
+ * rss-ui.mjs already imports this module — taking it the other way is a cycle.
+ */
+export function wrap(text, width, max = Infinity) {
+  const columns = Math.max(1, Math.floor(width));
+  const words = String(text ?? "").split(/\s+/).filter(Boolean);
+  const lines = [];
+  let line = "";
+  const flush = () => { if (line) { lines.push(line); line = ""; } };
+
+  for (const word of words) {
+    if (word.length > columns) {
+      flush();
+      for (let i = 0; i < word.length; i += columns) lines.push(word.slice(i, i + columns));
+      continue;
+    }
+    if (!line) { line = word; continue; }
+    if (line.length + 1 + word.length <= columns) { line += ` ${word}`; continue; }
+    flush();
+    line = word;
+  }
+  flush();
+  if (lines.length <= max) return lines;
+  // The dropped lines have to leave a mark, or the text simply appears to end
+  // where it was cut. Appended where there is room and cut into the last line
+  // where there is not, because a marker that pushes past `columns` is the one
+  // thing this function exists to prevent.
+  const kept = lines.slice(0, max);
+  const last = kept[max - 1];
+  kept[max - 1] = `${last.length < columns ? last : last.slice(0, Math.max(0, columns - 1))}…`;
+  return kept;
 }
 
-/** The headline list. */
-export function renderHeadlines(items, { failures = [], columns, limit = DEFAULT_LIMIT, now = Date.now(), source = "" } = {}) {
+/** At most this many lines of one headline. Three is a very long headline. */
+const TITLE_LINES = 3;
+
+/**
+ * The headline list.
+ *
+ * Wrapped rather than clipped to one line, which is the change that makes this
+ * readable. A single-line row spends its width on a fixed column for the feed
+ * name and the age, and what gives is the headline — so the one thing on the
+ * row you actually needed is the one thing cut off, and a press release titled
+ * "Lantern Pharma Establishes Open-Medicine AI as a Separate Company to
+ * Commercialize and Expand…" reads as "Establishes Open-Medicine AI as a
+ * Separate Compa…". The title now takes the full width and as many lines as it
+ * needs, and the attribution moves under it where it costs the headline
+ * nothing.
+ *
+ * `byHost` picks what each headline is attributed to. A search sets it: every
+ * row arrives on the one search feed, so a column reading "bing" nine times is
+ * a column that says nothing, while "tmcnet.com" against "finance.yahoo.com" is
+ * most of what tells you whether a result is worth opening. The reading list
+ * leaves it off, because there the feed name is the one you chose, the one
+ * `--feed` takes, and — for an aggregator like Hacker News, where every item
+ * links to a different host — the only stable thing on the row.
+ */
+export function renderHeadlines(items, {
+  failures = [], columns, limit = DEFAULT_LIMIT, now = Date.now(), source = "",
+  skipped = 0, byHost = false,
+} = {}) {
   const width = Math.max(48, Math.min(Number(columns) || 88, 100));
   const shown = items.slice(0, limit);
   if (!shown.length) {
     const lines = ["", `  ${ash("nothing came back")}`];
+    if (skipped) lines.push(`  ${ash(`${skipped} quote page${skipped === 1 ? " was" : "s were"} skipped — they were not news`)}`);
     if (failures.length) lines.push("", ...failureLines(failures));
     else lines.push("", `  ${ash("subscribe with")} ${bone("/news add <url>")}`);
     return lines.join("\n");
   }
 
-  // The widest index, so "9." and "10." line their titles up.
+  // The widest index, so "9." and "10." line their titles up, and everything
+  // under a headline hangs off that same margin.
   const gutter = String(shown.length).length + 1;
-  const tails = shown.map((item) => {
-    const when = ago(item.date, now);
-    return `${item.feed || ""}${when ? ` · ${when}` : ""}`.trim();
-  });
-  // One column width for every tail, not one per row: the feed name and the age
-  // are what make a headline placeable, so they keep their room and the title
-  // is what gives — and they line up, which is the whole point of a column.
-  const tailWidth = Math.max(0, ...tails.map((t) => t.length));
-  const room = Math.max(24, width - gutter - tailWidth - 4);
+  const indent = `  ${" ".repeat(gutter)} `;
+  const room = width - indent.length;
+
+  const head = [source || `${items.length} headline${items.length === 1 ? "" : "s"}`];
+  if (skipped) head.push(`${skipped} quote page${skipped === 1 ? "" : "s"} skipped`);
+  const lines = ["", `  ${ash(head.join(" · "))}`, ""];
 
-  const lines = ["", `  ${ash(source || `${items.length} headline${items.length === 1 ? "" : "s"}`)}`, ""];
   for (const [i, item] of shown.entries()) {
     const n = `${i + 1}.`.padStart(gutter);
-    lines.push(`  ${acid(n)} ${bone(clip(item.title, room).padEnd(room))} ${ash(tails[i].padStart(tailWidth))}`);
+    // An item with no title at all still gets its number and its meta line —
+    // parseFeed only keeps a titleless entry when it has a link worth opening.
+    const [first = "", ...rest] = wrap(item.title, room, TITLE_LINES);
+    lines.push(`  ${acid(n)} ${bone(first)}`);
+    for (const line of rest) lines.push(`${indent}${bone(line)}`);
+    const when = ago(item.date, now);
+    const who = byHost ? item.host || item.feed : item.feed || item.host;
+    const meta = [who || "", when].filter(Boolean).join(" · ");
+    if (meta) lines.push(`${indent}${ash(meta)}`);
+    if (i < shown.length - 1) lines.push("");
   }
+
   lines.push("", `  ${ash("open one with")} ${bone("/news open <n>")}`);
   if (failures.length) lines.push("", ...failureLines(failures));
   return lines.join("\n");
@@ -1222,17 +1368,19 @@ export async function newsCommand(argv = [], deps = {}) {
     }
   }
 
-  const { items, failures } = await collectNews(feeds, { fetchImpl, timeoutMs: request.timeoutMs });
+  const { items, failures, skipped } = await collectNews(feeds, { fetchImpl, timeoutMs: request.timeoutMs });
   const shown = items.slice(0, request.limit);
 
   if (request.json) {
-    out(JSON.stringify({ items: shown, failures, feeds: feeds.length }, null, 2));
+    out(JSON.stringify({ items: shown, failures, skipped, feeds: feeds.length }, null, 2));
   } else {
     out(renderHeadlines(items, {
       failures,
       columns,
       limit: request.limit,
       now,
+      skipped,
+      byHost: request.verb === "search",
       source: source ? `${source} · ${items.length} headline${items.length === 1 ? "" : "s"}` : "",
     }));
   }

package/src/rss-ui.mjs

@@ -13,7 +13,7 @@
 // Rendering is a pure function of state (`renderReader`), so a frame can be
 // asserted in a test without a tty, a fetch, or a keystroke.
 import { parseMouse } from "./herd-ui.mjs";
-import { acid, amber, ash, bone, danger, dim } from "./ui.mjs";
+import { acid, amber, ash, bone, danger, dim, pad, visible } from "./ui.mjs";
 import {
   ago,
   collectNews,
@@ -22,8 +22,14 @@ import {
   readingList,
   resolveVerb,
   searchFeeds,
+  wrap,
 } from "./news.mjs";
 
+// Written here, and moved to news.mjs when the plain listing needed the same
+// wrapping — re-exported so the name this module published stays where callers
+// and tests already look for it.
+export { wrap };
+
 /**
  * Verbs `/rss` hands straight to `moshcode news`.
  *
@@ -45,16 +51,10 @@ const SIDEBAR = 20;
 const HEADER_LINES = 2; // title + rule
 const FOOTER_LINES = 2; // rule + keys
 
-/** Printable width, ignoring the SGR sequences ui.mjs wraps text in. */
-export function visibleWidth(text) {
-  return String(text ?? "").replace(/\x1b\[[0-9;]*m/g, "").length;
-}
-
-/** Pad to `width` printable columns, colour codes not counted. */
-function pad(text, width) {
-  const short = width - visibleWidth(text);
-  return short > 0 ? text + " ".repeat(short) : text;
-}
+// Printable width, ignoring the SGR sequences ui.mjs wraps text in. Named
+// `visibleWidth` on the way out because the reader's tests and callers already
+// use that name; `pad` comes from the same place now.
+export { visible as visibleWidth };
 
 /** Truncate to `width` printable columns. Only ever called on uncoloured text. */
 function clip(text, width) {
@@ -62,37 +62,6 @@ function clip(text, width) {
   return s.length > width ? `${s.slice(0, Math.max(0, width - 1))}…` : s;
 }
 
-/**
- * Break `text` into lines of at most `width`, on word boundaries where it can.
- *
- * A word longer than the pane — which in practice means a URL — is split across
- * lines rather than truncated. It has to be split somehow: left whole it wraps
- * the terminal itself and every line below it lands one row low, which is the
- * one failure that tears the whole frame. Splitting rather than cutting because
- * the over-long word is usually the link, and half a link is not a link.
- */
-export function wrap(text, width) {
-  const columns = Math.max(1, Math.floor(width));
-  const words = String(text ?? "").split(/\s+/).filter(Boolean);
-  const lines = [];
-  let line = "";
-  const flush = () => { if (line) { lines.push(line); line = ""; } };
-
-  for (const word of words) {
-    if (word.length > columns) {
-      flush();
-      for (let i = 0; i < word.length; i += columns) lines.push(word.slice(i, i + columns));
-      continue;
-    }
-    if (!line) { line = word; continue; }
-    if (line.length + 1 + word.length <= columns) { line += ` ${word}`; continue; }
-    flush();
-    line = word;
-  }
-  flush();
-  return lines;
-}
-
 /**
  * Decode a chunk of raw-mode input.
  *
@@ -136,20 +105,48 @@ export function decodeKeys(buffer) {
   return events;
 }
 
+/**
+ * What a headline is grouped and filtered by.
+ *
+ * The feed it came from, except on a search — there every result arrives on the
+ * one search feed, so grouping by feed puts all of them in a single row called
+ * "bing" and the sidebar becomes a label rather than a filter. The publisher is
+ * the useful split instead.
+ *
+ * Only on a search, because the reverse is worse the rest of the time: a feed
+ * like Hacker News links out to a different host on nearly every item, so
+ * grouping subscribed feeds by publisher would replace thirteen feed names with
+ * several hundred one-item rows.
+ */
+export function groupOf(state, item) {
+  return (state.query ? item.host || item.feed : item.feed) || "";
+}
+
 /** Feeds down the left, with a count each and an "all" row on top. */
 export function sidebarRows(state) {
   const counts = new Map();
-  for (const item of state.items) counts.set(item.feed, (counts.get(item.feed) || 0) + 1);
+  for (const item of state.items) {
+    const key = groupOf(state, item);
+    counts.set(key, (counts.get(key) || 0) + 1);
+  }
   const rows = [{ key: null, label: "all", count: state.items.length }];
+  if (state.query) {
+    // Publishers, busiest first — there is no subscription order to fall back
+    // on, and the site that carried five of the results is the one worth seeing.
+    for (const [key, count] of [...counts].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))) {
+      if (key) rows.push({ key, label: key, count });
+    }
+    return rows;
+  }
   for (const feed of state.feeds) {
     rows.push({ key: feed.name, label: feed.name, count: counts.get(feed.name) || 0 });
   }
   return rows;
 }
 
-/** The headlines currently on show — everything, or one feed's. */
+/** The headlines currently on show — everything, or one feed's (one publisher's, on a search). */
 export function visibleItems(state) {
-  return state.filter ? state.items.filter((i) => i.feed === state.filter) : state.items;
+  return state.filter ? state.items.filter((i) => groupOf(state, i) === state.filter) : state.items;
 }
 
 /**
@@ -170,11 +167,14 @@ export function renderReader(state, { rows = 24, cols = 80 } = {}) {
   const where = state.query ? `“${state.query}”`
     : state.filter ? state.filter
     : state.usingDefaults ? "default feeds" : "all feeds";
-  const title = `  ${bone("moshcode rss")}${ash(`   ${items.length} headline${items.length === 1 ? "" : "s"} · ${where}`)}`;
+  // The quote pages collectNews set aside are counted here too — a reader that
+  // hides results without saying so is a reader you cannot trust the count of.
+  const aside = state.skipped ? ` · ${state.skipped} quote page${state.skipped === 1 ? "" : "s"} skipped` : "";
+  const title = `  ${bone("moshcode rss")}${ash(`   ${items.length} headline${items.length === 1 ? "" : "s"} · ${where}${aside}`)}`;
   const status = state.loading ? acid("loading…")
     : state.failures.length ? amber(`${state.failures.length} feed${state.failures.length === 1 ? "" : "s"} down`)
     : "";
-  out.push(pad(title, width - visibleWidth(status) - 2) + status + "  ");
+  out.push(pad(title, width - visible(status) - 2) + status + "  ");
   out.push(`  ${dim("─".repeat(Math.max(10, width - 4)))}`);
 
   // Body --------------------------------------------------------------------
@@ -220,7 +220,7 @@ function keyHint(state, width) {
   if (state.mode === "search") {
     const prompt = `${ash("search:")} ${bone(state.input)}${acid("▏")}`;
     const help = dim("   ⏎ run · esc cancel");
-    return visibleWidth(prompt + help) <= width ? prompt + help : prompt;
+    return visible(prompt + help) <= width ? prompt + help : prompt;
   }
   const keys = state.pane === "article"
     ? [["⏎/esc", "back"], ["o", "open"], ["j/k", "next/prev"], ["q", "quit"]]
@@ -230,7 +230,7 @@ function keyHint(state, width) {
   let line = "";
   for (const [key, what] of keys) {
     const next = (line ? line + sep : "") + `${acid(key)} ${ash(what)}`;
-    if (visibleWidth(next) > width) break;
+    if (visible(next) > width) break;
     line = next;
   }
   return line;
@@ -255,7 +255,7 @@ function listLines(state, items, { width, height }) {
   // above the available width is how a line ends up wider than the terminal.
   const tails = window.map((item) => {
     const when = ago(item.date, state.now);
-    return `${item.feed}${when ? ` · ${when}` : ""}`.trim();
+    return `${groupOf(state, item)}${when ? ` · ${when}` : ""}`.trim();
   });
   const tailWidth = Math.min(Math.max(0, ...tails.map((t) => t.length)), Math.floor(width / 2));
   const room = Math.max(1, width - tailWidth - 4);
@@ -355,6 +355,7 @@ export async function rssUi(argv = [], deps = {}) {
     query: query || null,
     items: [],
     failures: [],
+    skipped: 0,
     selected: 0,
     offset: 0,
     sideSelected: 0,
@@ -398,9 +399,10 @@ export async function rssUi(argv = [], deps = {}) {
   const load = async () => {
     state.loading = true;
     draw();
-    const { items, failures } = await collectNews(state.feeds, { fetchImpl });
+    const { items, failures, skipped } = await collectNews(state.feeds, { fetchImpl });
     state.items = items;
     state.failures = failures;
+    state.skipped = skipped || 0;
     state.now = Date.now();
     state.loading = false;
     state.selected = 0;

package/src/shell.mjs

@@ -0,0 +1,96 @@
+// One answer to "how does the pit run a shell command".
+//
+// The pit is not a shell, so everything it runs on the user's behalf goes out
+// through $SHELL: `!cmd`, `/shell`, a shell-valued alias from /alias, and
+// moshscript's shell(). The obvious spelling is `$SHELL -c "<cmd>"`, and it is
+// wrong in a way that costs an afternoon to find. `zsh -c` and `bash -c` are
+// non-interactive shells, and a non-interactive shell does not read ~/.zshrc or
+// ~/.bashrc — so the aliases and functions defined there are simply not there:
+//
+//   /alias set prs gh-prs-all     → zsh -c gh-prs-all
+//                                 → zsh:1: command not found: gh-prs-all
+//
+// while the identical word works when typed at a prompt. That is a bug rather
+// than a footnote, because naming a shell command is most of what /alias is
+// for, and the shell commands people name are the ones they already named once
+// in ~/.zsh_aliases. An alias that resolves at the prompt and not in the pit
+// makes the pit look broken, and from the user's side it is.
+//
+// So we ask for an interactive shell. `-i` is the switch that makes bash and
+// zsh read their rc file, and the rc file is where the user's shell actually
+// lives. Anything already on PATH worked before and still works; what changes
+// is that aliases and functions now resolve too.
+
+/**
+ * Shells whose startup file is read only when the shell is interactive.
+ *
+ * Deliberately just bash and zsh. fish sources config.fish however it was
+ * started, so it needs nothing from us; plain sh/dash have no rc file to miss
+ * and `-i` would only buy them job-control machinery; and a shell we have not
+ * heard of is likelier to be harmed by an unexpected flag than helped by it.
+ * Being wrong here means running a command in a shell that cannot see the
+ * user's aliases, which is exactly where we started — so an unknown shell
+ * lands on the old behaviour rather than on a guess.
+ */
+const RC_ON_INTERACTIVE = new Set(["bash", "zsh"]);
+
+/** Set this to opt a session out of rc loading and get plain `-c` back. */
+export const NO_RC_ENV = "MOSHCODE_SHELL_NO_RC";
+
+/** Windows has no rc file in this sense; cmd.exe wants its own flag spelling. */
+const CMD_FLAGS = ["/d", "/s", "/c"];
+
+/** The shell the user runs, or the platform's fallback. */
+export function shellPath(env = process.env, platform = process.platform) {
+  if (platform === "win32") return env.COMSPEC || "cmd.exe";
+  return env.SHELL || "/bin/sh";
+}
+
+/**
+ * `zsh` from `/usr/bin/zsh`, `bash` from `C:\...\bash.exe`.
+ *
+ * Both separators by hand rather than path.basename, which is bound to the
+ * platform the code is running on: it would leave a Windows path intact when
+ * asked on Linux, and this function is also asked about the other platform —
+ * shellInvocation takes `platform` as an option so the Windows branch can be
+ * tested from anywhere.
+ */
+export function shellName(shell) {
+  const tail = String(shell || "").split(/[\\/]/).pop() || "";
+  return tail.replace(/\.exe$/i, "");
+}
+
+/**
+ * How to spawn `rawCmd`, as { shell, args, flags, interactive }.
+ *
+ * `rawCmd` empty means "a shell to sit in" — no args at all, which is already
+ * an interactive shell and already reads the rc file.
+ *
+ * `tty` is why this takes options rather than reading the world directly. An
+ * interactive bash with no terminal attached prints
+ *
+ *   bash: cannot set terminal process group (…): Inappropriate ioctl for device
+ *   bash: no job control in this shell
+ *
+ * on stderr before it runs a thing, which would turn every headless run — cron,
+ * CI, `moshcode run script.mosh` in a pipeline — into noise around the output
+ * someone is trying to read. With a terminal attached, both shells are silent.
+ * So the rc file is loaded where a person is watching, which is the case that
+ * wanted it, and a headless run keeps the old quiet behaviour. zsh alone would
+ * not need the guard; the guard is not worth splitting per shell for.
+ */
+export function shellInvocation(rawCmd, {
+  env = process.env,
+  platform = process.platform,
+  tty = Boolean(process.stdin?.isTTY && process.stdout?.isTTY),
+} = {}) {
+  const shell = shellPath(env, platform);
+  const name = shellName(shell);
+  if (!rawCmd) return { shell, args: [], flags: "", interactive: true, name };
+  if (platform === "win32") {
+    return { shell, args: [...CMD_FLAGS, rawCmd], flags: CMD_FLAGS.join(" "), interactive: false, name };
+  }
+  const interactive = tty && RC_ON_INTERACTIVE.has(name) && !env[NO_RC_ENV];
+  const flags = interactive ? "-ic" : "-c";
+  return { shell, args: [flags, rawCmd], flags, interactive, name };
+}

package/src/tools.mjs

@@ -2,7 +2,8 @@
 // These are deliberately separate from coding engines: UGig owns marketplace
 // workflows, CoinPay owns payment workflows, c0mpute owns the compute network,
 // c0upons owns community coupons and bounties, the cloud CLIs below own
-// deploys/secrets/infra, and moshcode only conducts their native command lines.
+// deploys/secrets/infra, Coral owns read-only data access across those systems,
+// and moshcode only conducts their native command lines.
 import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -123,6 +124,18 @@ export const TOOLS = {
     // silently re-adding package repos.
     upgrade: { cmd: "tailscale", args: ["update"] },
   },
+  coral: {
+    desc: "Coral — read-only SQL across your APIs, databases, and internal systems",
+    bin: "coral",
+    // The vendor script resolves the latest GitHub release, verifies its
+    // sha256, and drops the binary in $HOME/.local/bin (CORAL_INSTALL_DIR
+    // overrides) — the same dir gh/supabase/doctl land in, so no binDirs.
+    // The script is POSIX sh, but withcoral.com documents `| bash`, so that is
+    // the pipeline we run. Re-running it is Coral's own documented upgrade path
+    // for a direct install, and toolUpgradeSpec falls back to install, so there
+    // is deliberately no upgrade key here.
+    install: { cmd: "bash", args: ["-c", "curl -fsSL https://withcoral.com/install.sh | bash"] },
+  },
   alpaca: {
     desc: "Alpaca — paper/live trading, market data, positions, and watchlists",
     bin: "alpaca",

package/src/tui.mjs

@@ -25,6 +25,7 @@ import { stocksCommand } from "./advisor.mjs";
 import { cryptoCommand } from "./crypto.mjs";
 import { gamesCommand } from "./games.mjs";
 import { canOpenBrowser, openBrowser } from "./open-url.mjs";
+import { shellInvocation } from "./shell.mjs";
 import { banner, hr, acid, ash, bone, dim, ok, err, warn, info, moshcodeVersion } from "./ui.mjs";
 import { CORE_CLI_COMMAND_NAMES } from "./cli-schema.mjs";
 import { RENAMED_COMMANDS, findPitCommand, pitHelpModel, renderPitCommand, suggest, wantsHelp } from "./help.mjs";
@@ -128,7 +129,7 @@ export function splitCommandLine(line) {
 }
 
 // Everything after the first word of a command line, exactly as typed. `/shell`
-// hands this straight to `$SHELL -c`, the same way `!cmd` does: the shell does
+// hands this straight to `$SHELL -ic`, the same way `!cmd` does: the shell does
 // its own parsing, so re-joining the tokenized parts would strip the user's
 // quotes and escapes and silently split `-m "two words"` into two arguments.
 function commandRemainder(line, words = 1) {
@@ -148,7 +149,7 @@ function commandRemainder(line, words = 1) {
  * quotes there belong to the shell. Tokenizing tells the two apart: exactly one
  * token means the whole value was quoted, so use it with the quotes stripped;
  * anything else is a bare command line, and it goes through verbatim so the
- * user's own quoting survives into `$SHELL -c`.
+ * user's own quoting survives into `$SHELL -ic`.
  */
 export function aliasValue(line) {
   const raw = commandRemainder(line, 3); // past "/alias", "set", "<name>"
@@ -508,12 +509,12 @@ async function openWorkflowTool(key, tool, args) {
 
 // Spawn the user's shell with the terminal fully handed over (stdio inherit),
 // inheriting the current cwd + env. No args → an interactive shell; a raw
-// command string → `$SHELL -c "<cmd>"` (one-off). Resolves { ok, code, signal }.
+// command string → `$SHELL -ic "<cmd>"` (one-off). Interactive so the command
+// can see the aliases and functions in ~/.zshrc — see src/shell.mjs for why
+// that is not optional. Resolves { ok, code, signal }.
 function runShell(rawCmd) {
   return new Promise((resolve) => {
-    const shell = process.env.SHELL
-      || (process.platform === "win32" ? (process.env.COMSPEC || "cmd.exe") : "/bin/sh");
-    const args = rawCmd ? ["-c", rawCmd] : [];
+    const { shell, args } = shellInvocation(rawCmd);
     let child;
     try { child = spawn(shell, args, { stdio: "inherit" }); }
     catch (e) { resolve({ ok: false, error: e }); return; }
@@ -525,9 +526,12 @@ function runShell(rawCmd) {
 // vim `:sh` — drop into a shell and land back at the mosh prompt on exit, with
 // the whole TUI session (history, cwd) intact. `rawCmd` runs a one-off instead.
 async function openShell(rawCmd) {
-  const shellName = path.basename(process.env.SHELL || "sh");
+  // The flags come from the same place the spawn does, so the echoed line is
+  // what actually ran — a `-c` printed above an `-ic` invocation is the kind of
+  // small lie that sends someone debugging the wrong shell.
+  const { flags, name: shellName } = shellInvocation(rawCmd);
   console.log(info(rawCmd
-    ? `${bone(shellName)} ${ash("-c")} ${ash(rawCmd)}`
+    ? `${bone(shellName)} ${ash(flags)} ${ash(rawCmd)}`
     : `dropping to ${bone(shellName)} — ${ash("`exit` or Ctrl-D brings you back to the pit")}`));
   console.log(hr());
   const r = await runShell(rawCmd);

package/src/ui.mjs

@@ -49,3 +49,239 @@ export function banner() {
 export function hr() {
   return ash("─".repeat(Math.min(process.stdout.columns || 60, 60)));
 }
+
+/* ------------------------------------------------- measuring and padding */
+
+// Colour codes are invisible but not zero-width to `.length`, so anything that
+// lines columns up has to measure the stripped string. Three modules had each
+// grown their own copy of this before it lived here — games.mjs, rss-ui.mjs and
+// the herd-ui test — which is the usual sign it belongs in one place. Getting
+// it wrong is how a table's right edge goes ragged the moment one cell is
+// coloured, and every caller here paints cells.
+const ANSI = /\x1b\[[0-9;]*m/g;
+
+/** `text` with every SGR sequence removed. */
+export const strip = (s) => String(s ?? "").replace(ANSI, "");
+
+/** Printable width of `text` in terminal columns, colour codes not counted. */
+export const visible = (s) => strip(s).length;
+
+/**
+ * Pad to `width` printable columns.
+ *
+ * Short-circuits rather than truncating when the text is already wider: a table
+ * that silently ate a long name would be worse than one column of ragged edge,
+ * and `clip` is right there for callers that would rather cut.
+ */
+export function pad(text, width, align = "left") {
+  const s = String(text ?? "");
+  const short = width - visible(s);
+  if (short <= 0) return s;
+  if (align === "right") return " ".repeat(short) + s;
+  if (align === "center") {
+    const left = Math.floor(short / 2);
+    return " ".repeat(left) + s + " ".repeat(short - left);
+  }
+  return s + " ".repeat(short);
+}
+
+/**
+ * Truncate to `width` printable columns, ellipsis included in the budget.
+ *
+ * Colour-aware on purpose. `slice` on a painted string can cut inside an escape
+ * sequence or drop the reset that ends one, and a terminal handed a colour it
+ * never gets told to stop using keeps it for everything printed afterwards —
+ * including the next command's output. So this walks the escapes, counts only
+ * what prints, and closes the run if the cut landed inside one.
+ *
+ * Whitespace is collapsed first, matching the copies in advisor.mjs and
+ * crypto.mjs this replaces: these are table cells, and a cell containing a
+ * newline breaks the row it sits in.
+ */
+export function clip(text, width, { collapse = true } = {}) {
+  let s = String(text ?? "");
+  // \s never appears inside an SGR sequence, so this cannot corrupt one.
+  if (collapse) s = s.replace(/\s+/g, " ").trim();
+  if (visible(s) <= width) return s;
+  if (width <= 0) return "";
+
+  const room = Math.max(1, width - 1); // one column reserved for the ellipsis
+  let out = "";
+  let printed = 0;
+  let painted = false;
+  for (let i = 0; i < s.length && printed < room; i++) {
+    if (s[i] === "\x1b") {
+      const match = /^\x1b\[[0-9;]*m/.exec(s.slice(i));
+      if (match) {
+        out += match[0];
+        painted = true;
+        i += match[0].length - 1;
+        continue;
+      }
+    }
+    out += s[i];
+    printed++;
+  }
+  // A full reset rather than ui.mjs's narrower `\x1b[39m`: the cut may have
+  // landed inside dim, or inside a colour some caller opened around us, and
+  // leaking either is the bug this function exists to avoid.
+  return out + (painted ? "\x1b[0m" : "") + "…";
+}
+
+/* --------------------------------------------------------------- layout */
+
+/**
+ * A column-aligned table, sized to its contents.
+ *
+ * The shape moshcode already prints by hand in advisor.mjs, crypto.mjs and
+ * herd-cli.mjs: a heading row, then rows of padded cells. Those all hardcode
+ * their widths, which is why a long ticker or a deep cwd pushes the columns out
+ * of line — this measures instead.
+ *
+ * `rows` are objects (addressed by `column.key`) or arrays (by position).
+ * Cells may be pre-painted; widths are measured with `visible`, so they line up
+ * anyway. Returns a string with no trailing newline, like `banner()`.
+ *
+ * ```
+ *   ticker   score   price
+ *   NVDA        92   $1,203.44
+ *   RIVN        41   $12.09
+ * ```
+ */
+export function table(rows, {
+  columns = [],
+  gap = 2,
+  indent = 2,
+  header = true,
+  rule = false,
+  max = Infinity,
+  paint = ash,
+} = {}) {
+  const cols = columns.map((c) => (typeof c === "string" ? { key: c, header: c } : c));
+  if (!cols.length) return "";
+  const body = Array.isArray(rows) ? rows : [];
+  const shown = body.slice(0, max);
+
+  const cell = (row, col, i) => {
+    const raw = Array.isArray(row) ? row[i] : row?.[col.key];
+    return raw == null ? "" : String(raw);
+  };
+
+  // A column is as wide as the widest thing in it, header included, unless the
+  // caller pinned it. Measured across the rows actually printed — sizing to
+  // rows cut by `max` would leave a gutter of dead space.
+  const widths = cols.map((col, i) => col.width ?? Math.max(
+    header ? visible(col.header ?? col.key ?? "") : 0,
+    ...shown.map((row) => visible(cell(row, col, i))),
+    0,
+  ));
+
+  const lead = " ".repeat(Math.max(0, indent));
+  const sep = " ".repeat(Math.max(1, gap));
+  const last = cols.length - 1;
+  // The final left-aligned column is emitted unpadded. Trailing spaces are
+  // invisible but real — they wrap early in a narrow terminal and show up in
+  // every snapshot — and trimming the finished line cannot remove them once a
+  // cell is painted, because the padding sits *inside* the colour codes, before
+  // the reset. Not adding it is the only thing that works for painted cells.
+  const fit = (text, i, align) => (i === last && (align ?? "left") === "left" ? String(text ?? "") : pad(text, widths[i], align));
+  // An empty final cell still gets its separator, so the trim is still needed —
+  // but it only has to remove literal spaces now, and with the last column left
+  // unpadded there are never any hiding inside a colour run for it to miss.
+  const line = (cells) => (lead + cells.join(sep)).replace(/ +$/, "");
+
+  const out = [];
+  if (header) {
+    out.push(line(cols.map((col, i) => paint(fit(col.header ?? col.key ?? "", i, col.align)))));
+    if (rule) out.push(line(widths.map((w) => ash("─".repeat(w)))));
+  }
+  for (const row of shown) {
+    out.push(line(cols.map((col, i) => fit(cell(row, col, i), i, col.align))));
+  }
+  if (body.length > shown.length) {
+    out.push(`${lead}${dim(`… ${body.length - shown.length} more`)}`);
+  }
+  return out.join("\n");
+}
+
+/** The box-drawing sets `panel` can frame with. */
+const BORDERS = {
+  round: "╭╮╰╯─│",
+  single: "┌┐└┘─│",
+  double: "╔╗╚╝═║",
+  bold: "┏┓┗┛━┃",
+};
+
+/**
+ * Frame `body` in a box, sized to its widest line.
+ *
+ * games.mjs has a `frame()` that does this for a game board with its own header
+ * and key line; this is the plain version for everything else. The title sits
+ * in the top edge rather than above it, which keeps a panel to one visual unit.
+ *
+ * ```
+ *   ╭─ herd ──────────────╮
+ *   │ api    claude  idle │
+ *   ╰─────────────────────╯
+ * ```
+ */
+export function panel(body, { title = "", width = 0, indent = 2, style = "round", paint = ash } = {}) {
+  const lines = (Array.isArray(body) ? body : String(body ?? "").split("\n")).map(String);
+  const [tl, tr, bl, br, h, v] = BORDERS[style] || BORDERS.round;
+  // The title has to fit between the corners with its two spacers and at least
+  // one run of edge on each side, or the top row comes out wider than the box.
+  const inner = Math.max(width, visible(title) ? visible(title) + 4 : 0, ...lines.map(visible), 0);
+  const lead = " ".repeat(Math.max(0, indent));
+
+  // The bottom edge is `inner + 4` wide: two corners and the two spacer columns
+  // the body sits between. A titled top has to come out the same, so its run of
+  // edge is whatever is left after `╭─ title ` and the closing corner —
+  // `inner - len - 1`, not `inner - len - 3`, which drew every titled panel two
+  // columns narrow and visibly ragged.
+  const top = visible(title)
+    ? `${tl}${h} ${title} ${h.repeat(Math.max(0, inner - visible(title) - 1))}${tr}`
+    : `${tl}${h.repeat(inner + 2)}${tr}`;
+
+  return [
+    lead + paint(top),
+    ...lines.map((l) => `${lead}${paint(v)} ${pad(l, inner)} ${paint(v)}`),
+    `${lead}${paint(`${bl}${h.repeat(inner + 2)}${br}`)}`,
+  ].join("\n");
+}
+
+/* --------------------------------------------------------------- charts */
+
+const SPARK_TICKS = "▁▂▃▄▅▆▇█";
+
+/**
+ * Render a series as one line of block characters.
+ *
+ * Lifted out of crypto.mjs, where it was the only chart in the codebase and
+ * private to price history. Nothing about it is about prices.
+ */
+export function sparkline(points) {
+  const values = (Array.isArray(points) ? points : []).map(Number).filter(Number.isFinite);
+  if (!values.length) return "";
+  const min = Math.min(...values);
+  const max = Math.max(...values);
+  // A flat series has no range to scale into; drawing it at the floor would
+  // imply a crash, so it sits mid-band instead.
+  if (max === min) return SPARK_TICKS[3].repeat(values.length);
+  return values
+    .map((v) => SPARK_TICKS[Math.min(SPARK_TICKS.length - 1, Math.floor(((v - min) / (max - min)) * SPARK_TICKS.length))])
+    .join("");
+}
+
+/**
+ * A horizontal meter: `████████░░░░  62%`.
+ *
+ * Clamped at both ends because the inputs are real — a download that reports
+ * more bytes than its own content-length, a quota already overspent — and a bar
+ * that renders past its track corrupts whatever is drawn to the right of it.
+ */
+export function gauge(value, { max = 1, width = 20, label = true, paint = acid } = {}) {
+  const ratio = max > 0 && Number.isFinite(value / max) ? Math.min(1, Math.max(0, value / max)) : 0;
+  const filled = Math.round(ratio * width);
+  const bar = paint("█".repeat(filled)) + dim("░".repeat(Math.max(0, width - filled)));
+  return label ? `${bar}  ${ash(`${Math.round(ratio * 100)}%`)}` : bar;
+}