Skip to content

tools: install and drive profullstack/cli-tools - #429

Merged
ralyodio merged 1 commit into
mainfrom
tools-cli-tools
Aug 19, 2026
Merged

tools: install and drive profullstack/cli-tools#429
ralyodio merged 1 commit into
mainfrom
tools-cli-tools

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds cli-tools to the workflow tools moshcode can install and pass through, now that profullstack/cli-tools is public.

moshcode install cli-tools     # then /cli-tools list, /cli-tools update

One step puts blog-post, domainfree, domainjson, gh-prs, gh-prs-merge, gh-prs-fix-all and tcfeed on PATH, and /cli-tools … reaches them from the pit.

Why this entry is shaped differently

The tool is a set of commands, not one binary, which changes three of the fields:

  • bin probes the cli-tools dispatcher, not any of the commands it installs. Several of those names (gh-prs, tcfeed) may already exist from an older hand-rolled checkout, so probing one of them would report the set installed when it is not.
  • binDirs covers ~/.local/bin for the same reason turso, gradient and kimi need it: the installer symlinks there and appends nothing to PATH, so the shell that ran the install cannot see the result.
  • upgrade is the tool's own updater, not a re-run of the installer. Re-running the installer would be wrong here — cli-tools update pulls and relinks the checkout that actually owns the commands, wherever it lives, and refuses to move a dirty or diverged tree rather than discarding work.

Checks

node --test test/tools.test.mjs — 32/32 pass, including a new case asserting the four points above and the existing install-script table extended with cli-tools.

Also ran the suites that enumerate TOOLS (completion, help, tui, upgrade, escalate-prime, completion-uninstall, upgrade-install-missing, upgrade-prime-sudo): 133 pass, 1 skipped, 0 fail.

Installer verified end to end from the public URL into a sandbox: links all 8 commands, re-run is idempotent.

🤖 Generated with Claude Code

Adds cli-tools to the workflow tools moshcode can install and pass through, so
`moshcode install cli-tools` puts blog-post, domainfree, domainjson, gh-prs,
gh-prs-merge, gh-prs-fix-all and tcfeed on PATH in one step, and `/cli-tools …`
reaches them from the pit.

The entry is shaped a little differently from its neighbours because the tool is
a *set* of commands rather than one binary. `bin` probes the `cli-tools`
dispatcher rather than any of the commands it installs: several of those names
(gh-prs, tcfeed) may already exist from an older hand-rolled checkout, so
probing one of them would report the set installed when it is not.

binDirs covers ~/.local/bin for the same reason turso, gradient and kimi need
it — the installer symlinks there and appends nothing to PATH, so the shell that
ran the install cannot see the result.

`upgrade` is the tool's own updater rather than a re-run of the installer.
Re-running the installer would be wrong here: `cli-tools update` pulls and
relinks the checkout that actually owns the commands, wherever it lives, and
refuses to move a dirty or diverged tree rather than discarding work.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 2 file(s) this pull request changes.

Nothing in the files this pull request changes.

55 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 5 | **MEDIUM**: 44 | **LOW**: 6

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:79
HIGH sh-remote-script-execution install.sh:83
HIGH tls-verification-disabled src/dns.mjs:741
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:68
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:108
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:295
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:299
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:344
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:568
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:749
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:751
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:810
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:856
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:926
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1029
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1052
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1074

…and 35 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 473681a into main Aug 19, 2026
6 checks passed
@ralyodio
ralyodio deleted the tools-cli-tools branch August 19, 2026 13:22
@ralyodio ralyodio mentioned this pull request Aug 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant