0.12.0: companions — timer and billing install with the set - #26
Merged
Conversation
`moshcode install cli-tools` now also puts @profullstack/timer and @profullstack/billing on the box, which is the whole point: one install, and /timer and /billing work in the pit (moshcode hands both straight to these CLIs once they exist). A companion is a command this set ships but does not implement — a published npm package with its own binary. They are deliberately not bin/*.ts like everything else: they run on Windows, which this install cannot (symlinks into a git checkout executed through an `npx tsx` shebang), and they are useful with no checkout at all, under any agentic CLI. Vendoring them to make one list tidier would cost them both of those. So this is their front door, not their implementation. cli-tools companions [--install [--force]] `link` installs the missing ones, `update` reinstalls at @latest — a bare `npm install -g <pkg>` leaves an already-satisfied version in place, so without the tag update would silently never move them. `unlink` leaves them installed: they work without this checkout, and `npm rm -g` is not a decision to make on somebody's behalf. install.sh runs them through the checkout's own dispatcher rather than $PREFIX/cli-tools, so it still works on a box where another checkout owns that name, and warns rather than dying like the Stripe block. CLI_TOOLS_NO_COMPANIONS=1 skips the lot. Two things the shape refuses to get wrong. An already-installed companion is left alone unless --force: it may be a newer version, a local build or a fork somebody is testing, which is the same surprise `link` refuses for symlinks. And npm exiting 0 is not reported as success when the binary is still not on PATH — npm will happily install into a prefix nobody can reach, and saying "installed" there sends you to a command you cannot run. KNOWN_VERBS is now exported and held against USAGE by a test. The old inline allowlist going stale has a quiet symptom — a verb documented in the help falls through to the command passthrough and answers "unknown command" — and it had already happened to `help` once. It happened again to `companions` while writing this. The test also caught that `help` and `where` are dispatched but missing from the synopsis, so it reads the Commands: block too. 455 tests.
ThreatCrush Security Scan13 finding(s) HIGH/CRITICAL: 5 | MEDIUM: 1 | LOW: 7
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
moshcode install cli-toolsnow also puts@profullstack/timerand@profullstack/billingon the box. That is the whole point: one install, and/timerand/billingwork in the pit — moshcode hands both straight to these CLIs once they exist (moshcode#439).What a companion is
A command this set ships but does not implement: a published npm package that brings its own binary.
They are deliberately not
bin/*.tslike everything else. They run on Windows, which this install cannot — it is symlinks into a git checkout executed through annpx tsxshebang — and they are useful with no checkout at all: under any agentic CLI, from a Dockerfile, on a box that has never heard of this repository. Vendoring them to make one list tidier would cost them both of those. Socli-toolsis their front door, not their implementation.Where they hook in
cli-tools companions [--install [--force]]cli-tools linkcli-tools update@latestcli-tools listFrom npm:blockinstall.shcli-tools unlinkupdatenames@latestexplicitly because a barenpm install -g <pkg>leaves an already-satisfied version in place — without the tag, update would silently never move them.unlinkleaves them because they work without this checkout, andnpm rm -gis not a decision to make on somebody's behalf.install.shruns them through the checkout's own dispatcher rather than$PREFIX/cli-tools, so it still works on a box where another checkout owns that name.CLI_TOOLS_NO_COMPANIONS=1skips the lot.Two things the shape refuses to get wrong
An already-installed companion is left alone unless
--force. It may be a newer version, a local build, or a fork somebody is testing — the same surpriselinkrefuses for symlinks.npm exiting 0 is not success if the binary is still not on PATH. npm will happily install into a prefix nobody can reach; reporting "installed" there sends you to a command you cannot run. That is the gap turso and gradient have in moshcode.
A stale allowlist, caught twice
KNOWN_VERBSis now exported and held againstUSAGEby a test. The old inline list going stale has a quiet symptom — a verb documented in the help falls through to the command passthrough and answersunknown command— and it had already happened tohelponce. It happened again tocompanionswhile writing this, which is why the test exists. It also caught thathelpandwhereare dispatched but missing from the synopsis, so it reads theCommands:block too.Verified
Installed for real on this box, not mocked:
pnpm test455 passing,pnpm typecheckclean,sh -n install.shclean.🤖 Generated with Claude Code
https://claude.ai/code/session_01KVUZsx4WBZK5rnJJFGgwF5