moshcode 0.65.0 → 0.67.0

package/README.md

@@ -14,6 +14,28 @@ curl -fsSL https://moshcoding.com/install.sh | sh
 Zero-dependency ESM — all it needs is Node.js 18+. Later: `… | sh -s -- update`
 to upgrade, `… | sh -s -- remove` to uninstall.
 
+## What is in this repo
+
+The CLI is the root package — `bin/`, `src/`, `plugins/` — and that is what
+`npm publish` and the installer above ship. Two apps live alongside it:
+
+| path | what it is | deployed as |
+|---|---|---|
+| `apps/pwa` | the Moshpit registry and account app | pit.moshcode.sh, app.moshcode.sh |
+| `apps/qryptchat-web` | QryptChat, the post-quantum messenger | qrypt.chat |
+
+One repo, but **not one dependency tree**. Each app installs itself, with its
+own lockfile, and the root `pnpm install` does not reach into either. That is
+deliberate on both counts and `pnpm-workspace.yaml` says why. The practical
+rule: run `pnpm install` in the directory you are working in, not at the root
+and not the other way round.
+
+The two apps share a feature rather than code — a person can sign in to
+QryptChat by proving they hold a Moshpit name, which `moshcode name link`
+produces the proof for. The shared half of that is still duplicated in both
+trees; see `pnpm-workspace.yaml` for what has to be fixed before it can be
+lifted into `packages/`.
+
 ## Commands
 
 `moshcode help <command>` drills into any of these — flags, examples and all.
@@ -48,6 +70,7 @@ or miss one that does. A test fails the build when it drifts.
 | `moshcode load` | account | bring your saved pit settings onto this machine |
 | `moshcode console` | account | serve or connect to the browser terminal |
 | `moshcode dns` | hosting | resolve Moshpit names on this machine |
+| `moshcode name` | hosting | prove you hold a Moshpit name, so an app can use it as your identity |
 | `moshcode doh` | hosting | run the DNS-over-HTTPS resolver |
 | `moshcode site` <br>`serve` | hosting | install web-server config for a Moshpit name |
 | `moshcode template` <br>`templates` | hosting | scaffold a stack for a Moshpit-hosted service |
@@ -590,6 +613,40 @@ moshcode ugig --json gigs list    # arguments/output go straight to ugig
 moshcode coinpay wallet balance   # arguments/output go straight to coinpay
 ```
 
+### BufferOverride — the failure in front of you, already answered
+
+[BufferOverride](https://bufferoverride.com) is where humans and agents debug
+together: every answer declares the versions it works on, who or what wrote it,
+and whether anyone independent reproduced it. `bo` is that from a terminal.
+
+```sh
+moshcode install bo               # npm i -g @profullstack/bufferoverride
+
+moshcode bo run -- pnpm test      # run it, keep what it printed, search for it
+moshcode bo search "worker exited before finishing"
+moshcode bo get a1b2c3d4e5 --markdown
+```
+
+The product is BufferOverride and the binary is `bo` — the same split
+`secrets`/`logicsrc` and `spinifex`/`spx` have, keyed the short way round here
+because this is a command you type every time something fails.
+
+`bo run --` wraps a command rather than replacing it: the wrapped command's exit
+code passes straight through, so it can go in front of something already in CI
+without changing what CI sees. It captures stdout, stderr, the exit code, the
+OS, the architecture and the detected dependency versions, redacts what it
+recognises as a secret, and searches for the failure **before** offering to
+publish it. Nothing leaves the machine until you have seen it, and outside a TTY
+nothing is published at all unless you pass `--ask`.
+
+Redaction is best effort and cannot be complete — no pattern list catches a
+custom-format secret — so `--dry-run` is the habit its own docs ask for.
+
+Reads need no credential: `search` and `get` work before you have ever run `bo
+login`. Publishing needs one, and `bo login` is a device-code exchange, so a
+terminal never handles a browser session. `bo mcp config` prints the MCP
+registration for a coding agent, which is the same graph over a different door.
+
 ### Cloud + infra CLIs
 
 ```sh
@@ -665,6 +722,32 @@ engines, `mcpjam` tells you whether that server is healthy first — health
 checks, OAuth conformance, tool-surface diffing, and structured triage from the
 terminal or CI. Re-running `moshcode install mcpjam` is also its upgrade path.
 
+### Alchemy — onchain data, wallets, and x402
+
+```sh
+moshcode install alchemy          # npm i -g @alchemy/cli
+
+moshcode alchemy auth             # browser login, then pick an app
+moshcode alchemy evm balance --address 0x…
+moshcode alchemy --json --no-interactive wallet send …
+```
+
+[Alchemy](https://www.alchemy.com/)'s CLI covers four things from one binary:
+querying onchain data across EVM and Solana (balances, NFTs, transfers, prices,
+blocks, logs, traces, simulations, raw RPC), managing Alchemy apps, networks,
+allowlists and webhooks, driving an agent-ready wallet (sends, swaps, contract
+calls, approvals, cross-chain bridges), and paying third-party x402 APIs in
+USDC under a spend cap.
+
+`alchemy auth` opens a browser to link your account and saves the selected app's
+API key; API keys and x402 wallet auth work too, depending on the command. Pass
+`--json --no-interactive` when a script or agent is driving, which is also what
+makes it read like the rest of the roster in a pipeline. It needs Node 22 or
+newer, and re-running `moshcode install alchemy` is its upgrade path.
+
+Where CoinPay is the payments product MoshCode ships alongside, Alchemy is the
+read side of the same world — the chain itself rather than one wallet's ledger.
+
 `gh`, `supabase`, and `doctl` publish no cross-platform install script, so
 MoshCode resolves the latest GitHub release and drops the binary in
 `$MOSHCODE_BIN` (default `~/.local/bin`) — no sudo, no package manager. Set
@@ -805,6 +888,29 @@ survive between sessions. A name that is already a pit command, an engine, or a
 tool is refused rather than shadowed — built-ins are dispatched first, so such
 an alias would never run.
 
+Some workflow tools ship a *set* of commands rather than one binary, and propose
+short words for them. Installing such a tool configures those words too — a
+dispatcher fronting seven commands is not reachable from the pit until the names
+that reach them exist:
+
+```text
+/install cli-tools                # or /tools install cli-tools
+✓ cli-tools installed. 🤘
+  ✓ /blog → blog-post
+  ✓ /free → domainfree
+```
+
+`/upgrade` does the same, because an upgrade is where a tool *gains* commands —
+a roster adopted once at install time otherwise goes stale the first time the
+tool ships something new. `/alias install <tool>` (or `--all`) re-runs it on
+demand, for tools you installed before this existed.
+
+The tool proposes and the pit disposes: moshcode reads the suggestions and
+writes the file, so nothing else reaches into a config it does not own. A name
+you bound yourself always wins — your `/prs` may carry `--orgs` flags a generic
+suggestion knows nothing about — and a tool that offers nothing, or cannot be
+asked, is silent rather than turning a successful install into an error.
+
 ### Social posting from the pit
 
 The pit can hand a prepared post to Bluesky or Nostr without storing either
@@ -989,6 +1095,7 @@ Some MCP servers are worth remembering by name rather than by npx invocation:
 ```sh
 moshcode mcp catalog              # what we know how to run
 moshcode mcp add porkbun          # expands to: npx -y @porkbunllc/mcp-server
+moshcode mcp add bufferoverride   # expands to: https://bufferoverride.com/mcp
 ```
 
 That registers it across every engine that supports MCP (claude, gemini, qwen,
@@ -1010,6 +1117,23 @@ from and five to rotate. Porkbun's API access is off by default and enabled
 per-domain — and its documentation tools work with no keys at all, which is a
 sensible way to try the server before trusting it with DNS writes.
 
+**BufferOverride is the useful-unauthenticated one.** Five read tools
+(`search_questions`, `get_question`, `list_questions`, `list_tags`, `whoami`)
+work with no credential, and the write tools are gated on the scopes a key
+actually carries — `tools/list` advertises only what your key can use. So the
+bare `mcp add bufferoverride` above is a complete, working registration. To
+publish from an engine, add the credential as a header:
+
+```sh
+moshcode mcp add bufferoverride -H "Authorization: Bearer bo_..."
+```
+
+`bo mcp config` prints the same thing from a terminal that has already signed
+in, and `bo mcp config --no-token` prints a form safe to paste in public. It is
+registered under the name the CLI uses, so both routes produce one server rather
+than two. See [BufferOverride](#bufferoverride--the-failure-in-front-of-you-already-answered)
+above for the CLI itself.
+
 ## Claude Code plugins
 
 MoshCode publishes its own plugin marketplace, so the pit's slash commands work
@@ -1322,6 +1446,7 @@ chmod +x deploy.mosh
 | `coinpay(args…)` | drive the coinpay workflow CLI |
 | `c0mpute(args…)` | drive the c0mpute workflow CLI |
 | `c0upons(args…)` | drive the c0upons workflow CLI |
+| `bo(args…)` | drive the BufferOverride CLI (capture a failure, search, ask, answer, verify) |
 | `secrets(args…)` | drive the logicsrc secrets CLI |
 | `railway(args…)` | drive the Railway CLI |
 | `gh(args…)` | drive the GitHub CLI |
@@ -1334,6 +1459,7 @@ chmod +x deploy.mosh
 | `alpaca(args…)` | drive the native Alpaca trading CLI |
 | `mcpjam(args…)` | drive the MCPJam CLI (test, debug, and validate MCP servers) |
 | `spinifex(args…)` | drive the Spinifex CLI (`spx` — AWS-compatible cloud on your own hardware) |
+| `alchemy(args…)` | drive the Alchemy CLI (onchain data, apps, wallets, x402) |
 | `trade(args…)` | look up tickers, inspect markets, preview/place Alpaca orders |
 | `stocks(args…)` | research tickers via advis0r (`stocksRead` returns the data) |
 | `crypto(args…)` | research crypto pairs via advis0r (`cryptoRead` returns the data) |

package/bin/moshcode.mjs

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import { runScript } from "../src/runtime.mjs";
-import { moshVocabulary } from "../src/commands.mjs";
+import { isReserved, moshVocabulary } from "../src/commands.mjs";
 import {
   agentLaunchArgs,
   engineList,
@@ -14,7 +14,7 @@ import {
   resolveExecutable,
   runCmd,
 } from "../src/engines.mjs";
-import { TOOLS, toolList, toolStatus, resolveTool, openTool } from "../src/tools.mjs";
+import { TOOLS, toolList, toolStatus, resolveTool, openTool, adoptAliasLines } from "../src/tools.mjs";
 import { tradeArgs, tradeUsage } from "../src/trade.mjs";
 import { runUpgrade } from "../src/upgrade.mjs";
 import { selfUpdateCommand } from "../src/selfupdate.mjs";
@@ -33,6 +33,7 @@ import { consoleCommand } from "../src/console.mjs";
 import { herdCommand, herdStart, splitDetachArgs } from "../src/herd-cli.mjs";
 import { detectSubstrate, substrateNote } from "../src/herd.mjs";
 import { dnsCommand } from "../src/dns.mjs";
+import { nameCommand } from "../src/name-link.mjs";
 import { templateCommand } from "../src/templates.mjs";
 import { serveCommand } from "../src/serve.mjs";
 import { createDohServer, nginxDohSite, parseDohPort, parseGuardArgs, DEFAULT_DOH_PORT, DOH_PATH } from "../src/doh-server.mjs";
@@ -456,7 +457,14 @@ async function main() {
       process.exitCode = 1;
       return;
     }
-    if (result.code === 0) console.log(`\n✓ ${target} installed. run it with \`${bin}\`. 🤘`);
+    if (result.code === 0) {
+      console.log(`\n✓ ${target} installed. run it with \`${bin}\`. 🤘`);
+      // Installing is also configuring: a tool that ships a set of commands is
+      // not usable from the pit until the words that reach them exist. Quiet
+      // for everything that offers none, and a name already in the file is
+      // reported by the adopter rather than replaced.
+      for (const line of adoptAliasLines(target, entry, { isReserved })) console.log(line);
+    }
     return backToPit(`install ${target}`, result.code);
   }
   if (cmd === "uninstall" || cmd === "remove") {
@@ -538,6 +546,10 @@ async function main() {
     process.exitCode = (await dnsCommand(rest)) || 0;
     return;
   }
+  if (cmd === "name") {
+    process.exitCode = (await nameCommand(rest)) || 0;
+    return;
+  }
   if (cmd === "doh") {
     const nameAt = rest.indexOf("--nginx");
     if (nameAt >= 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.65.0",
+  "version": "0.67.0",
   "type": "module",
   "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {
@@ -18,7 +18,7 @@
   "scripts": {
     "start": "node bin/moshcode.mjs",
     "demo": "node bin/moshcode.mjs run examples/alive.mosh",
-    "test": "node --test"
+    "test": "node --test \"test/**/*.test.mjs\" \"tests/**/*.test.mjs\" \"apps/pwa/test/**/*.test.mjs\""
   },
   "files": [
     "bin",

package/src/aliases.mjs

@@ -158,3 +158,68 @@ export function expandAlias(value, args = "") {
   const line = `${String(value).trim()}${args ? ` ${args}` : ""}`;
   return /^[/!]/.test(line) ? line : `!${line}`;
 }
+
+/**
+ * How many aliases one tool may offer in a single install.
+ *
+ * A bound, not a judgement about any tool: the proposal is a subprocess's
+ * stdout being written into the operator's config, and an unbounded loop over
+ * whatever it printed is how a bug in a tool becomes a thousand-line
+ * aliases.json. No CLI here offers more than a handful.
+ */
+export const MAX_PROPOSED = 64;
+
+/**
+ * Merge a tool's proposed aliases into the operator's file, in one write.
+ *
+ * Existing names always win. The file is the operator's: silently repointing a
+ * word they bound themselves is the kind of change nothing surfaces until the
+ * wrong command runs — and the pit's own aliases carry flags (`--orgs`,
+ * `--apply`) that a tool's generic suggestion does not know about.
+ *
+ * Names that collide with a pit command, engine, or tool are refused rather
+ * than written, for the reason setAlias refuses them: built-ins are resolved
+ * first, so such an alias would be silently dead.
+ *
+ * Returns { ok, error, added, kept, refused } — each a list of
+ * { name, value, previous? , reason? } so the caller can say what happened
+ * without re-deriving it.
+ */
+export function mergeAliases(proposed, { isReserved = () => false } = {}) {
+  const added = [];
+  const kept = [];
+  const refused = [];
+  if (!proposed || typeof proposed !== "object" || Array.isArray(proposed)) {
+    return { ok: false, error: "that isn't a set of aliases", added, kept, refused };
+  }
+
+  const existing = loadAliases();
+  const merged = { ...existing };
+  // Sorted so the report reads the same way twice regardless of the order the
+  // tool happened to print, and truncated rather than refused: a tool that
+  // offers too many still gets its first MAX_PROPOSED written, and the caller
+  // is told what was dropped.
+  const entries = Object.entries(proposed).sort(([a], [b]) => a.localeCompare(b));
+  const dropped = Math.max(0, entries.length - MAX_PROPOSED);
+
+  for (const [rawName, rawValue] of entries.slice(0, MAX_PROPOSED)) {
+    const name = normalizeName(rawName);
+    const value = typeof rawValue === "string" ? rawValue.trim() : "";
+    if (!name) { refused.push({ name: String(rawName), reason: "not a usable alias name" }); continue; }
+    if (!value) { refused.push({ name, reason: "nothing to run" }); continue; }
+    if (value.includes("\n")) { refused.push({ name, reason: "an alias is a single line" }); continue; }
+    if (value.length > MAX_VALUE) { refused.push({ name, reason: `${value.length} characters — the cap is ${MAX_VALUE}` }); continue; }
+    if (isReserved(name)) { refused.push({ name, reason: "already a pit command, engine, or tool" }); continue; }
+    if (Object.hasOwn(existing, name)) { kept.push({ name, value: existing[name], proposed: value }); continue; }
+    merged[name] = value;
+    added.push({ name, value });
+  }
+
+  // Nothing new is still a success — "already up to date" is the common case on
+  // a second run, and writing the file again to say so would only churn mtime.
+  if (added.length) {
+    try { saveAliases(merged); }
+    catch (e) { return { ok: false, error: `can't write ${aliasFile()}: ${e.message}`, added: [], kept, refused }; }
+  }
+  return { ok: true, added, kept, refused, dropped };
+}

package/src/cli-schema.mjs

@@ -214,8 +214,11 @@ export const CORE_CLI_COMMANDS = [
     examples: [
       ["moshcode install claude", "an engine"],
       ["moshcode install gh", "a workflow tool"],
+      ["moshcode install cli-tools", "a set of commands — its pit aliases come too"],
     ],
     seeAlso: ["uninstall", "upgrade", "engines", "tools"],
+    note: "a tool that ships a set of commands can propose pit aliases for them; "
+      + "installing it adopts the ones you have not already bound yourself.",
   },
   {
     name: "uninstall",
@@ -391,6 +394,22 @@ export const CORE_CLI_COMMANDS = [
     ],
     seeAlso: ["doh", "site"],
   },
+  {
+    name: "name",
+    group: "hosting",
+    description: "prove you hold a Moshpit name, so an app can use it as your identity",
+    synopsis: [["moshcode name link <name> [--app <url>]", ""]],
+    flags: [
+      ["--app <url>", "the app to prove the name to", "https://qrypt.chat"],
+      ["--dir <path>", "where the name's key and certificate live", "/etc/ssl/moshpit"],
+      ["--json", "print the proof bundle as machine-readable JSON", ""],
+    ],
+    examples: [
+      ["sudo moshcode name link chovy.hacker", "the key is root-owned"],
+      ["sudo moshcode name link blue.eggs --json", "hand the bundle to a script"],
+    ],
+    seeAlso: ["dns", "site", "whoami"],
+  },
   {
     name: "doh",
     group: "hosting",
@@ -1176,23 +1195,26 @@ export const PIT_COMMANDS = [
     description: "show the current dir + git repo/branch/origin" },
   { name: "shell", aliases: ["sh"], args: "[cmd]", pitOnly: true,
     description: "drop into $SHELL (exit → back to the pit); also !cmd" },
-  { name: "alias", aliases: ["aliases"], args: 'set <name> "<cmd>" | list | get | rm', pitOnly: true,
+  { name: "alias", aliases: ["aliases"], args: 'set <name> "<cmd>" | list | get | rm | install <tool>', pitOnly: true,
     description: "name a line you keep retyping; /<name> runs it",
     synopsis: [
       ['/alias set <name> "<command>"', "define one (also: /alias <name> \"<command>\")"],
       ["/alias [list] [--json]", "every alias"],
       ["/alias get <name>", "what one expands to"],
       ["/alias rm <name>", "forget one"],
+      ["/alias install <tool> | --all", "re-adopt a tool's aliases (/install does it too)"],
     ],
     examples: [
       ['/alias set gs "git status"', "then /gs — and /gs -sb appends"],
       // Deliberately not `cc`: that one is already how the pit spells claude,
       // so the example would print a refusal for anyone who typed it.
       ['/alias set cx "/agents codex"', "a pit command, not a shell one"],
+      ["/alias install cli-tools", "/blog, /free, /whois — from the tool itself"],
       ["/alias rm gs", ""],
     ],
     note: "the command runs in $SHELL unless it starts with / — then it is a pit command. "
-      + "Aliases live in ~/.moshcode/aliases.json and cannot shadow a pit command, engine, or tool.",
+      + "Aliases live in ~/.moshcode/aliases.json and cannot shadow a pit command, engine, or tool. "
+      + "/alias install never overwrites a name you bound yourself.",
   },
   { name: "help", aliases: ["?", "h"], args: "[command]", pitOnly: true,
     description: "this, or one command in detail" },

package/src/commands.mjs

@@ -81,7 +81,7 @@ function expectNoArgs(name, args) {
  * setAlias() takes) rather than an exported list, so this stays the caller's
  * answer and not a second roster to drift from the first.
  */
-function isReserved(name) {
+export function isReserved(name) {
   const key = String(name).toLowerCase();
   return CORE_CLI_COMMAND_NAMES.includes(key)
     || PIT_COMMANDS.some((c) => (typeof c === "string" ? c : c.name) === key);
@@ -668,6 +668,7 @@ const COMMANDS = [
   cliVerb("coinpay", "drive the coinpay workflow CLI"),
   cliVerb("c0mpute", "drive the c0mpute workflow CLI"),
   cliVerb("c0upons", "drive the c0upons workflow CLI"),
+  cliVerb("bo", "drive the BufferOverride CLI (capture a failure, search, ask, answer, verify)"),
   cliVerb("secrets", "manage/view team secrets via logicsrc (login, teams, credentials)"),
   cliVerb("railway", "drive the Railway CLI (deploys, services, env vars)"),
   cliVerb("gh", "drive the GitHub CLI (repos, PRs, issues, releases)"),
@@ -681,6 +682,7 @@ const COMMANDS = [
   cliVerb("alpaca", "drive the native Alpaca trading CLI"),
   cliVerb("mcpjam", "drive the MCPJam CLI (test, debug, and validate MCP servers)"),
   cliVerb("spinifex", "drive the Spinifex CLI (spx — AWS-compatible cloud on your own hardware)"),
+  cliVerb("alchemy", "drive the Alchemy CLI (onchain data, apps, wallets, x402)"),
   cliVerb("trade", "look up tickers, inspect markets, and preview/place Alpaca orders"),
   cliVerb("pwd", "print the current repo/location"),
 

package/src/integrations.mjs

@@ -238,9 +238,14 @@ export async function mcpCommand(tokens, { run, installedSet } = {}) {
   const missing = (parsed.catalog?.env || []).filter((k) => !process.env[k]);
   if (missing.length) {
     console.log(ash(`  note: ${spec.name} needs ${missing.join(" and ")} in the environment.`));
-    if (parsed.catalog?.note) console.log(ash(`        ${parsed.catalog.note}`));
-    if (parsed.catalog?.docs) console.log(ash(`        ${parsed.catalog.docs}`));
   }
+  // The catalog's own note and docs are printed whenever the catalog was used,
+  // not only when a variable is missing. A server whose credential is a header
+  // rather than an environment variable — or one that needs none at all to be
+  // useful — has nothing in `env`, and hanging its note off that check is what
+  // made the note invisible for exactly the servers it was written for.
+  if (parsed.catalog?.note) console.log(ash(`  note: ${parsed.catalog.note}`));
+  if (parsed.catalog?.docs) console.log(ash(`        ${parsed.catalog.docs}`));
   if (spec.headers.length || /^https?:/i.test(spec.target)) {
     console.log(ash("  note: OAuth/HTTP servers may still need per-engine auth (e.g. `opencode mcp auth`, `codex mcp login`)."));
   }

package/src/mcp-catalog.mjs

@@ -24,6 +24,23 @@ export const MCP_CATALOG = {
     // before deciding whether to trust it with keys.
     note: "API access is off by default and must be enabled per-domain; the docs tools work without keys",
   },
+  bufferoverride: {
+    // A remote HTTP server, so the target is the URL and there are no args —
+    // every engine's builder pushes the target alone for a remote server.
+    target: "https://bufferoverride.com/mcp",
+    args: [],
+    desc: "BufferOverride — version-aware technical answers, with provenance and reproductions",
+    docs: "https://bufferoverride.com/docs/mcp",
+    // Named to match what the CLI's own `bo mcp config` emits, so registering
+    // it either way produces one server rather than two under different names.
+    //
+    // No `env`: the credential is a bearer header, not a variable, and it is
+    // deliberately not listed here. Five read tools work with no key at all,
+    // and the write tools are gated on the scopes a key actually carries — so
+    // the useful default really is unauthenticated. `bo mcp config` prints the
+    // header form for a terminal that has signed in.
+    note: "reads need no credential; to publish, add -H \"Authorization: Bearer bo_…\" (see `bo mcp config`)",
+  },
 };
 
 /** Resolve a catalog name to a spec fragment, or null. Own properties only. */
@@ -44,7 +61,10 @@ export function catalogNames() {
 
 /** One line per known server, for `mcp catalog`. */
 export function catalogList() {
+  // Width from the longest name rather than a fixed pad: `bufferoverride` is
+  // wider than the old 10, and a name that overruns the pad loses the column.
+  const width = Math.max(10, ...Object.keys(MCP_CATALOG).map((key) => key.length));
   return Object.entries(MCP_CATALOG)
-    .map(([key, e]) => `  ${key.padEnd(10)} ${e.desc}`)
+    .map(([key, e]) => `  ${key.padEnd(width)} ${e.desc}`)
     .join("\n");
 }

package/src/name-link.mjs

@@ -0,0 +1,259 @@
+// `moshcode name link <name>` — prove you hold a Moshpit name, so an app can
+// use it as your identity.
+//
+// The registry already publishes, per name, the SHA-256 of the SubjectPublicKeyInfo
+// that name's certificate must present (see src/pins.mjs). That pin is a
+// name-to-key binding nobody else can forge, which makes it a credential: sign
+// something with the pinned key and you have proved you hold the name.
+//
+// What this does NOT do is generate the app's encryption key. The pinned key is
+// P-256 and it signs; a messenger's key is ML-KEM-1024 and it encrypts, and a
+// KEM key cannot sign at all. They are two keys with two jobs, and the private
+// half of the second one belongs on the device the person actually reads
+// messages on — not here. So this emits a proof bundle and stops. The app posts
+// it alongside a key it generated itself and never showed anyone.
+//
+// The bundle is single-use and short-lived: the challenge it answers is burned
+// on redemption, so a copy of it is worth nothing once used.
+
+import fs from "node:fs";
+import crypto from "node:crypto";
+
+/** Where an app that speaks this protocol lives, unless told otherwise. */
+export const DEFAULT_APP = "https://qrypt.chat";
+
+/** Where moshcode's own tooling writes a name's key and certificate. */
+export const DEFAULT_KEY_DIR = "/etc/ssl/moshpit";
+
+/**
+ * A name is `<label>.<tld>`, lowercase.
+ *
+ * Empty segments are refused rather than collapsed. `chovy..hacker` folding
+ * into `chovy.hacker` is harmless in a filename and is a way in when the string
+ * is an identity.
+ *
+ * @param {unknown} input
+ * @returns {string | null}
+ */
+export function normalizeName(input) {
+  const clean = String(input ?? "").trim().toLowerCase().replace(/\.$/, "");
+  if (!clean) return null;
+  const parts = clean.split(".");
+  if (parts.length !== 2 || parts.some((p) => !p)) return null;
+  if (!parts.every((p) => /^[a-z0-9-]+$/.test(p) && !p.startsWith("-") && !p.endsWith("-"))) return null;
+  return parts.join(".");
+}
+
+/**
+ * Where a name's key and certificate live.
+ *
+ * Mirrors keyPaths() in src/pins.mjs, including that separators which could
+ * climb out of the directory are dropped rather than escaped.
+ *
+ * @param {string} name
+ * @param {string} [dir]
+ */
+export function keyPaths(name, dir = DEFAULT_KEY_DIR) {
+  const safe = String(name ?? "")
+    .toLowerCase()
+    .replace(/[^a-z0-9.-]/g, "")
+    .replace(/\.{2,}/g, ".")
+    .replace(/^[.-]+|[.-]+$/g, "");
+  if (!safe) return null;
+  return { key: `${dir}/${safe}.key`, cert: `${dir}/${safe}.crt` };
+}
+
+/**
+ * Sign a challenge with a name's private key.
+ *
+ * DER, because that is what `crypto.verify` reads back with `dsaEncoding: 'der'`
+ * on the other side. A P-1363 signature is the same numbers in a shape the
+ * verifier rejects, and the failure looks identical to a wrong key.
+ *
+ * @param {{keyPem: string, nonce: string}} args
+ * @returns {string} base64 signature
+ */
+export function signChallenge({ keyPem, nonce }) {
+  const key = crypto.createPrivateKey(keyPem);
+  return crypto
+    .sign("sha256", Buffer.from(nonce, "utf8"), { key, dsaEncoding: "der" })
+    .toString("base64");
+}
+
+/**
+ * The pin a certificate's key hashes to — SHA-256 over the SPKI, base64.
+ * Shown so the operator can eyeball it against what the registry publishes
+ * before wondering why a proof was refused.
+ *
+ * @param {string} certPem
+ */
+export function pinOf(certPem) {
+  const cert = new crypto.X509Certificate(certPem);
+  const der = cert.publicKey.export({ type: "spki", format: "der" });
+  return crypto.createHash("sha256").update(der).digest("base64");
+}
+
+/**
+ * Ask an app for a challenge to sign.
+ *
+ * @param {{app: string, name: string, fetchImpl?: typeof fetch}} args
+ */
+export async function fetchChallenge({ app, name, fetchImpl = fetch }) {
+  const url = `${app.replace(/\/+$/, "")}/api/auth/moshpit/challenge`;
+  const res = await fetchImpl(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name }),
+  });
+
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+    body = null;
+  }
+
+  if (!res.ok) {
+    throw new Error(body?.error || `${app} answered ${res.status}`);
+  }
+  if (!body?.jti || !body?.nonce) {
+    throw new Error(`${app} did not return a challenge`);
+  }
+  return body;
+}
+
+/**
+ * Read a name's key and certificate off disk, with the failure a person can act on.
+ *
+ * The key is root-owned, so "permission denied" is the expected first
+ * experience and deserves the fix rather than the errno.
+ *
+ * @param {{name: string, keyPath: string, certPath: string, readFile?: (p: string, e: string) => string}} args
+ */
+export function readNameKey({ name, keyPath, certPath, readFile = (p, e) => fs.readFileSync(p, e) }) {
+  let keyPem;
+  try {
+    keyPem = readFile(keyPath, "utf8");
+  } catch (error) {
+    if (error.code === "EACCES") {
+      throw new Error(`cannot read ${keyPath} — it is root-owned, so run this with sudo`);
+    }
+    if (error.code === "ENOENT") {
+      throw new Error(`no key for ${name} at ${keyPath} — mint one before linking it`);
+    }
+    throw error;
+  }
+
+  let certPem;
+  try {
+    certPem = readFile(certPath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(`no certificate for ${name} at ${certPath}`);
+    }
+    throw error;
+  }
+
+  return { keyPem, certPem };
+}
+
+/**
+ * Parse `name link <name> [--app url] [--dir path] [--json]`.
+ * @param {string[]} argv
+ */
+export function parseArgs(argv) {
+  const flag = (name, fallback) => {
+    const at = argv.indexOf(`--${name}`);
+    return at >= 0 && argv[at + 1] ? argv[at + 1] : fallback;
+  };
+  const positional = argv.filter((a, i) => {
+    if (a.startsWith("--")) return false;
+    // Skip a value that belongs to the flag before it.
+    return !(i > 0 && argv[i - 1].startsWith("--") && argv[i - 1] !== "--json");
+  });
+
+  return {
+    verb: positional[0] || "",
+    name: positional[1] || "",
+    app: flag("app", DEFAULT_APP),
+    dir: flag("dir", DEFAULT_KEY_DIR),
+    json: argv.includes("--json"),
+  };
+}
+
+/**
+ * `moshcode name link <name>` — fetch a challenge, sign it, print the bundle.
+ *
+ * @param {string[]} argv
+ * @param {{out?: (s: string) => void, err?: (s: string) => void, fetchImpl?: typeof fetch,
+ *          readFile?: (p: string, e: string) => string}} [io]
+ * @returns {Promise<number>} exit code
+ */
+export async function nameCommand(argv, io = {}) {
+  const out = io.out || ((s) => console.log(s));
+  const err = io.err || ((s) => console.error(s));
+  const { verb, name: raw, app, dir, json } = parseArgs(argv);
+
+  if (verb !== "link") {
+    err("usage: moshcode name link <name> [--app <url>] [--dir <path>] [--json]");
+    return 1;
+  }
+
+  const name = normalizeName(raw);
+  if (!name) {
+    err(`not a Moshpit name: ${raw || "(none)"} — expected <label>.<tld>`);
+    return 1;
+  }
+
+  const paths = keyPaths(name, dir);
+  if (!paths) {
+    err(`not a Moshpit name: ${raw}`);
+    return 1;
+  }
+
+  let keyPem;
+  let certPem;
+  try {
+    ({ keyPem, certPem } = readNameKey({
+      name,
+      keyPath: paths.key,
+      certPath: paths.cert,
+      readFile: io.readFile,
+    }));
+  } catch (error) {
+    err(error.message);
+    return 1;
+  }
+
+  let challenge;
+  try {
+    challenge = await fetchChallenge({ app, name, fetchImpl: io.fetchImpl });
+  } catch (error) {
+    err(`could not get a challenge from ${app}: ${error.message}`);
+    return 1;
+  }
+
+  let signature;
+  try {
+    signature = signChallenge({ keyPem, nonce: challenge.nonce });
+  } catch (error) {
+    err(`could not sign with ${paths.key}: ${error.message}`);
+    return 1;
+  }
+
+  const bundle = { jti: challenge.jti, name, certPem, signature };
+
+  if (json) {
+    out(JSON.stringify(bundle));
+    return 0;
+  }
+
+  out(`Proved ${name} against ${app}`);
+  out(`  pin      ${pinOf(certPem)}`);
+  out(`  expires  ${challenge.expiresAt || "shortly"}`);
+  out("");
+  out("Paste this into the app to finish linking. It is single-use:");
+  out("");
+  out(JSON.stringify(bundle));
+  return 0;
+}

package/src/tools.mjs

@@ -4,10 +4,12 @@
 // c0upons owns community coupons and bounties, the cloud CLIs below own
 // deploys/secrets/infra, Coral owns read-only data access across those systems,
 // and moshcode only conducts their native command lines.
+import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { mergeAliases } from "./aliases.mjs";
 import { isInstalled, openPassthrough } from "./engines.mjs";
 
 // gh, supabase, and doctl publish only GitHub release binaries — no official
@@ -69,6 +71,29 @@ export const TOOLS = {
     // elsewhere, and `cli-tools update` refuses to move a dirty or diverged
     // tree rather than discarding work.
     upgrade: { cmd: "cli-tools", args: ["update"] },
+    // The pit aliases this set offers. Read at the end of /install and
+    // /upgrade, so installing the set is also configuring it — seven commands
+    // behind one dispatcher are not reachable from the pit until the words that
+    // reach them exist. `/alias install cli-tools` re-runs it on demand.
+    //
+    // Declared rather than probed: a command that prints a set of aliases is
+    // only safe to run against a tool we already know answers it, and an
+    // `aliases --json` guessed at every installed CLI would eventually hit one
+    // where those words mean something else entirely.
+    aliases: { cmd: "cli-tools", args: ["aliases", "--json"] },
+  },
+  bo: {
+    desc: "BufferOverride — capture a failing command, redact it, and find the answer that already exists",
+    // The product is BufferOverride and the binary is `bo`, the same split
+    // `secrets` → `logicsrc` and `spinifex` → `spx` have. It is keyed the other
+    // way round from those two on purpose: `bo` is what its own documentation
+    // tells you to type, and this is a command you run every time something
+    // fails, so the short word is the one worth having in the pit.
+    bin: "bo",
+    // An ordinary global npm package with no dependencies of its own, and
+    // `npm install -g` is idempotent, so re-running the install IS the upgrade
+    // — no `upgrade` key, the same as mcpjam and railway.
+    install: { cmd: "npm", args: ["install", "-g", "@profullstack/bufferoverride"] },
   },
   secrets: {
     desc: "LogicSRC — end-to-end-encrypted team credential sharing (login, teams, credentials)",
@@ -269,6 +294,22 @@ export const TOOLS = {
     // migrations, and restarts the services. toolUpgradeSpec falls back to
     // install, so there is deliberately no upgrade key.
   },
+  alchemy: {
+    desc: "Alchemy — onchain data, apps and webhooks, agent wallets, and x402 payments (EVM + Solana)",
+    bin: "alchemy",
+    // An ordinary global npm package, and `npm install -g` is idempotent, so
+    // re-running the install IS the upgrade — same shape as mcpjam, hence no
+    // upgrade key. Its postinstall only prints a banner on a global install:
+    // the skill-sync branch above it needs a skills-lock.json that the
+    // published tarball does not ship, so nothing reaches out or is written.
+    //
+    // No installHelp: that line is for a MISSING installer (alpaca's go,
+    // gradient's python3), and npm is already here — moshcode runs on it. The
+    // package does declare node >=22, which npm warns about rather than
+    // refuses; the CLI then says so itself on first run, which is a better
+    // place to hear it than an install that succeeded.
+    install: { cmd: "npm", args: ["install", "-g", "@alchemy/cli"] },
+  },
 };
 
 /** Resolve a name to `[key, tool]`, or null. */
@@ -306,6 +347,90 @@ export function openTool(tool, args = [], opts = {}) {
   return openPassthrough(tool, args, opts);
 }
 
+/** The command that prints a tool's proposed pit aliases, or null. */
+export function toolAliasSpec(tool) {
+  return tool?.aliases || null;
+}
+
+/**
+ * Adopt a tool's aliases and describe the result in plain lines.
+ *
+ * The unpainted counterpart to the pit's renderer, for `moshcode install` —
+ * which is a plain-stdout surface, and may be a script's stdout. Returns [] for
+ * everything with nothing to say, so hanging this off an install costs a tool
+ * that offers no aliases exactly one function call and no output.
+ *
+ * Silent on failure by design: an installer that succeeded must not be followed
+ * by an error about a nicety, and `/alias install <tool>` says the same thing
+ * loudly for anyone who goes looking.
+ */
+export function adoptAliasLines(key, tool, { isReserved = () => false, read = readToolAliases } = {}) {
+  if (!toolAliasSpec(tool)) return [];
+  const answer = read(tool);
+  if (!answer.ok) return [];
+  const result = mergeAliases(answer.aliases, { isReserved });
+  if (!result.ok || !result.added.length) return [];
+  return [
+    `\n${key} also offers ${result.added.length} pit alias${result.added.length === 1 ? "" : "es"}:`,
+    ...result.added.map(({ name, value }) => `  /${name} → ${value}`),
+    ...(result.kept.length ? [`  (kept ${result.kept.length} you had already bound)`] : []),
+  ];
+}
+
+/** Every tool that offers pit aliases, as `[key, tool]`. */
+export function toolsWithAliases() {
+  return Object.entries(TOOLS).filter(([, tool]) => toolAliasSpec(tool));
+}
+
+/**
+ * How long a tool gets to print its aliases before we stop waiting.
+ *
+ * This runs on an interactive verb, so the failure we care about is a CLI that
+ * blocks on something — a login prompt, a network read — rather than one that
+ * is merely slow. Printing a constant should take milliseconds.
+ */
+const ALIAS_TIMEOUT_MS = 10_000;
+
+/**
+ * Ask a tool for the pit aliases it proposes: `{ ok, aliases, error }`.
+ *
+ * Captured rather than passed through, because the output is data we are about
+ * to merge into the operator's config and not something to put on their
+ * screen. Every failure is a returned reason instead of a throw — a tool that
+ * is not installed, prints nothing, or prints something that is not JSON is an
+ * ordinary outcome of this verb, not an error the pit should fall over on.
+ *
+ * `run` is injectable so the tests do not need seven CLIs on PATH.
+ */
+export function readToolAliases(tool, { run = spawnSync } = {}) {
+  const spec = toolAliasSpec(tool);
+  if (!spec) return { ok: false, error: "offers no aliases" };
+  let result;
+  try {
+    result = run(spec.cmd, spec.args, {
+      encoding: "utf8",
+      timeout: ALIAS_TIMEOUT_MS,
+      // No inherited stdin: a tool that decides to ask a question here would
+      // otherwise hang the pit on a prompt nobody can see.
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+  if (result.error) return { ok: false, error: result.error.message };
+  if (result.status !== 0) {
+    const said = String(result.stderr || "").trim().split("\n")[0];
+    return { ok: false, error: said || `${spec.cmd} exited ${result.status}` };
+  }
+  let parsed;
+  try { parsed = JSON.parse(String(result.stdout || "")); }
+  catch { return { ok: false, error: `${spec.cmd} didn't print JSON` }; }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, error: `${spec.cmd} printed JSON, but not a set of aliases` };
+  }
+  return { ok: true, aliases: parsed };
+}
+
 // Generic utilities used by the app/package surface.
 
 /**

package/src/tui.mjs

@@ -8,7 +8,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { ENGINES, agentLaunchArgs, resolveEngine, engineStatus, openSession } from "./engines.mjs";
-import { TOOLS, resolveTool, toolStatus, openTool } from "./tools.mjs";
+import { TOOLS, resolveTool, toolStatus, openTool, readToolAliases, toolsWithAliases } from "./tools.mjs";
 import { tradeArgs, tradeUsage } from "./trade.mjs";
 import { postSocial, socialRoster } from "./socials.mjs";
 import { runUpgrade } from "./upgrade.mjs";
@@ -31,7 +31,7 @@ import { banner, hr, acid, ash, bone, dim, ok, err, warn, info, moshcodeVersion
 import { CORE_CLI_COMMAND_NAMES } from "./cli-schema.mjs";
 import { RENAMED_COMMANDS, findPitCommand, pitHelpModel, renderPitCommand, suggest, wantsHelp } from "./help.mjs";
 import { openNewTab } from "./tabs.mjs";
-import { MAX_EXPANSIONS, expandAlias, getAlias, loadAliases, removeAlias, setAlias } from "./aliases.mjs";
+import { MAX_EXPANSIONS, expandAlias, getAlias, loadAliases, mergeAliases, removeAlias, setAlias } from "./aliases.mjs";
 import { herdCommand, herdStart, renderRoster, roster, splitDetachArgs } from "./herd-cli.mjs";
 import { detectSubstrate, substrateNote } from "./herd.mjs";
 
@@ -269,6 +269,115 @@ function printAliases({ json = false } = {}) {
   }
 }
 
+/**
+ * `/alias install <tool>` — adopt the pit aliases a workflow tool offers.
+ *
+ * The tools in src/tools.mjs are separate products with their own release
+ * cycles, and several of them ship a set of commands rather than one binary.
+ * Which short words those deserve at this prompt is a question only the tool
+ * can answer, and only moshcode can act on: the file is ours, so a tool that
+ * wrote it directly would be reaching into a config it does not own — the same
+ * objection that keeps `railway setup agent` out of /install.
+ *
+ * So the tool proposes and the pit disposes. Deliberately its own verb rather
+ * than a step inside /install: writing the operator's aliases is a side effect
+ * an install command has no business having, and the roster is worth adopting
+ * long after the day a tool was installed.
+ */
+function aliasInstallCommand(args) {
+  const all = args.includes("--all");
+  const names = args.filter((a) => !a.startsWith("-"));
+  if (!all && !names.length) {
+    const offered = toolsWithAliases().map(([key]) => key);
+    console.log(err("usage: /alias install <tool> | --all"));
+    console.log(ash(offered.length
+      ? `   tools that offer aliases: ${offered.join(", ")}`
+      : "   no tool offers aliases yet"));
+    return;
+  }
+
+  const wanted = all
+    ? toolsWithAliases()
+    : names.map((name) => [name, resolveTool(name)?.[1] ?? null]);
+
+  // A run over --all reports per tool, because "3 added, 2 kept" for a roster
+  // is the useful shape; a single named tool reports per alias, because those
+  // are the words you are about to type.
+  let touched = 0;
+  for (const [key, tool] of wanted) {
+    if (!tool) { console.log(err(`no tool named "${key}" — /tools for the roster`)); continue; }
+    touched += adoptToolAliases(key, tool, { compact: all, quiet: false });
+  }
+  if (touched) console.log(ash("   run one with /<name> · /alias list for all of them"));
+}
+
+/**
+ * Read one tool's proposed aliases, merge them, and say what happened.
+ *
+ * The one place that does this, because three surfaces need it: `/install` and
+ * `/tools install` at the end of an install, `/upgrade` after a tool has gained
+ * commands, and `/alias install` on its own. Returns how many names were added
+ * so a caller can decide whether the run is worth a closing line.
+ *
+ * `quiet` is what makes it safe to hang off an install: a tool that offers
+ * nothing, or that cannot be asked, must not print a failure after a install
+ * that actually succeeded. Only real adoptions and genuine surprises speak up.
+ */
+function adoptToolAliases(key, tool, { compact = false, quiet = false } = {}) {
+  const label = acid(`/${key}`);
+  if (!tool?.aliases) {
+    if (!quiet) console.log(info(`${label} offers no aliases`));
+    return 0;
+  }
+  const read = readToolAliases(tool);
+  if (!read.ok) {
+    if (quiet) return 0;
+    console.log(err(`${label} — ${read.error}`));
+    if (!isInstalledTool(key)) console.log(ash(`   not installed here — /install ${key}`));
+    return 0;
+  }
+  const result = mergeAliases(read.aliases, { isReserved: isReservedName });
+  if (!result.ok) {
+    if (!quiet) console.log(err(`${label} — ${result.error}`));
+    return 0;
+  }
+
+  if (compact) {
+    const parts = [`${result.added.length} added`];
+    if (result.kept.length) parts.push(`${result.kept.length} kept`);
+    if (result.refused.length) parts.push(`${result.refused.length} refused`);
+    console.log(`  ${label.padEnd(20)} ${ash(parts.join(", "))}`);
+    return result.added.length;
+  }
+
+  for (const { name, value } of result.added) {
+    console.log(`  ${ok(`${acid(`/${name}`)} ${ash("→")} ${bone(value)}`)}`);
+  }
+  // Named rather than counted: an alias the operator already owns is the one
+  // case where nothing changed *and* they need to know which word it was,
+  // because theirs and the tool's suggestion are both plausible. Suppressed
+  // after an install, where a list of names that did not change is noise
+  // between the installer's output and the prompt.
+  if (!quiet) {
+    for (const { name, value } of result.kept) {
+      console.log(`  ${info(`kept your own ${acid(`/${name}`)} ${ash(`(${value})`)}`)}`);
+    }
+  }
+  for (const { name, reason } of result.refused) {
+    console.log(`  ${warn(`skipped ${acid(`/${name}`)} ${ash(`— ${reason}`)}`)}`);
+  }
+  if (result.dropped) console.log(ash(`   ${result.dropped} more offered than one run writes`));
+  if (!quiet && !result.added.length && !result.kept.length && !result.refused.length) {
+    console.log(info(`${label} offers no aliases`));
+  }
+  return result.added.length;
+}
+
+/** Is this tool's native executable present? Used only to explain a failure. */
+function isInstalledTool(key) {
+  return Boolean(toolStatus().find((entry) => entry.key === key)?.installed);
+}
+
 /**
  * `/alias` — define, list, and forget the shortcuts (src/aliases.mjs).
  *
@@ -289,6 +398,13 @@ function aliasCommand(rest, line) {
     printAliases({ json });
     return;
   }
+  // Before `set`, because `install` is a verb and not a name: falling through
+  // to the bare-`/alias <name> <value>` shorthand would define an alias called
+  // "install" pointing at whatever came next.
+  if (sub === "install" || sub === "adopt") {
+    aliasInstallCommand(args);
+    return;
+  }
   if (sub === "set" || sub === "add") {
     const name = args[0];
     const value = aliasValue(line);
@@ -322,7 +438,7 @@ function aliasCommand(rest, line) {
   // when there is a value after it, or `/alias gs` would silently define
   // nothing.
   if (args.length) { aliasCommand(["set", ...rest], `/alias set ${commandRemainder(line)}`); return; }
-  console.log(err(`unknown /alias verb "${verb}" — set, list, get, rm`));
+  console.log(err(`unknown /alias verb "${verb}" — set, list, get, rm, install`));
 }
 
 /**
@@ -446,6 +562,16 @@ function printPwd() {
 async function upgradeAll(targets) {
   console.log(info(`upgrading ${bone("moshcode")} + installed engines/tools — hand-off to each updater…`));
   await runUpgrade(targets, { log: (s) => console.log(s), rule: () => console.log(hr()) });
+  // An upgrade is where a tool *gains* commands, so it is the moment its new
+  // shortcuts should appear — a roster adopted once at install time otherwise
+  // goes stale the first time the tool ships something new. Quiet and
+  // never-overwrite, exactly as at install.
+  const wanted = targets?.length
+    ? toolsWithAliases().filter(([key]) => targets.includes(key))
+    : toolsWithAliases();
+  let added = 0;
+  for (const [key, tool] of wanted) added += adoptToolAliases(key, tool, { quiet: true });
+  if (added) console.log(ash(`   ${added} new alias${added === 1 ? "" : "es"} · /alias list for all of them`));
 }
 
 // The live mirror for this pit, once /sessions is watching. Module-level so the
@@ -599,7 +725,18 @@ function installTarget(key) {
       if (e.code === "ENOENT" && target.installHelp) console.log(info(target.installHelp));
       resolve();
     });
-    child.on("exit", (code) => { console.log(hr()); console.log(code === 0 ? ok(`${key} installed. 🤘`) : err(`install exited ${code}`)); resolve(); });
+    child.on("exit", (code) => {
+      console.log(hr());
+      if (code !== 0) { console.log(err(`install exited ${code}`)); return resolve(); }
+      console.log(ok(`${key} installed. 🤘`));
+      // Installing a tool is also configuring it: a set of commands is not
+      // usable from the pit until the words that reach them exist. Quiet, so a
+      // tool with nothing to offer — every engine, and most tools — finishes
+      // exactly as it did before. Names you bound yourself are never touched.
+      const added = Object.hasOwn(TOOLS, key) ? adoptToolAliases(key, TOOLS[key], { quiet: true }) : 0;
+      if (added) console.log(ash(`   ${added} alias${added === 1 ? "" : "es"} from ${key} · /alias list for all of them`));
+      resolve();
+    });
   });
 }
 
@@ -892,6 +1029,18 @@ export async function tui() {
     }
     if (cmd === "tools") {
       if (!rest[0]) { printTools(); continue; }
+      // `/tools install <name>` reads as the obvious spelling to anyone who has
+      // just been shown the roster by `/tools`, and resolveTool would otherwise
+      // answer it with `unknown tool "install"` — a dead end pointing at the
+      // wrong word. Same for the verbs that pair with it.
+      if (["install", "upgrade", "update"].includes(rest[0].toLowerCase()) && rest[1]) {
+        const verb = rest[0].toLowerCase();
+        rl.close();
+        if (verb === "install") await installTarget(rest[1].toLowerCase());
+        else await upgradeAll(rest.slice(1).map((r) => r.toLowerCase()));
+        rl = mkrl();
+        continue;
+      }
       const resolved = resolveTool(rest[0]);
       if (!resolved) { console.log(err(`unknown tool "${rest[0]}". try: ${Object.keys(TOOLS).join(", ")}`)); continue; }
       const [key, tool] = resolved;