moshcode - npm Package Compare versions

Comparing version 0.57.0 to 0.58.0

package.json

 {
   "name": "moshcode",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "type": "module",
@@ -5,0 +5,0 @@ "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",

src/tui.mjs

@@ -467,2 +467,31 @@ // The moshcode shell — run `moshcode` with no args. A metal prompt that opens
 
+/**
+ * How fast an exit has to be before it is worth remarking on.
+ *
+ * A person who opens an agent and immediately quits takes longer than this.
+ * Nothing that actually started a session lands under it.
+ */
+const INSTANT_EXIT_MS = 1500;
+
+/**
+ * The note for a hand-off that ended the moment it began, or null.
+ *
+ * A CLI that exits 0 without doing anything is indistinguishable, from out
+ * here, from one the operator opened and closed — both are "exited (code 0)",
+ * which reads as success and sent somebody looking for the bug in the wrong
+ * program. It happens for real: @serjm/deepseek-code 0.5.0 compares
+ * `resolve(process.argv[1])` against `import.meta.url` to decide whether it is
+ * the entrypoint, and npm installs every global bin as a symlink, so the
+ * comparison fails and the whole CLI silently runs nothing.
+ *
+ * Timing is all we have — the child owns the terminal, so its output is not
+ * ours to inspect — and it is enough to say "this looks wrong" without
+ * claiming to know why.
+ */
+export function instantExitNote({ key, bin, code, ms }) {
+  if (code !== 0 || ms >= INSTANT_EXIT_MS) return null;
+  return `${key} exited instantly without running — that usually means a broken install, not a clean session.`
+    + ` check it directly with \`${bin} --version\`, and reinstall with /install ${key} if that prints nothing.`;
+}
+
 async function openEngine(key, engine, args, { agentMode = false } = {}) {
@@ -483,3 +512,5 @@ if (!engine.installed && !args.length) {
   activeMirror?.setEngine(key);
+  const startedAt = Date.now();
   const r = await openSession(engine, agentMode ? agentLaunchArgs(engine, args) : args, { onOutput: childSink() });
+  const elapsed = Date.now() - startedAt;
   activeMirror?.setEngine(null);
@@ -493,2 +524,4 @@ console.log(hr());
     console.log(info(`${key} exited${r.code != null ? ` (code ${r.code})` : ""}. back in the pit.`));
+    const note = instantExitNote({ key, bin: engine.bin, code: r.code, ms: elapsed });
+    if (note) console.log(warn(note));
   }
@@ -503,3 +536,5 @@ }
   console.log(hr());
+  const toolStartedAt = Date.now();
   const result = await openTool(tool, args, { onOutput: childSink() });
+  const toolElapsed = Date.now() - toolStartedAt;
   console.log(hr());
@@ -512,2 +547,4 @@ if (!result.ok) {
     console.log(info(`${key} exited${result.code != null ? ` (code ${result.code})` : result.signal ? ` (${result.signal})` : ""}. back in the pit.`));
+    const note = instantExitNote({ key, bin: tool.bin, code: result.code, ms: toolElapsed });
+    if (note) console.log(warn(note));
   }
@@ -514,0 +551,0 @@ }

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 4 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 4 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1480403

0.12%

Lines of code

26740

0.13%

No dependency changes