moshcode - npm Package Compare versions

Comparing version 0.60.0 to 0.61.0

package.json

 {
   "name": "moshcode",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "type": "module",
@@ -5,0 +5,0 @@ "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",

src/commands.mjs

@@ -683,2 +683,3 @@ // The moshscript command vocabulary — the verbs a .mosh script can call.
   cliVerb("mcpjam", "drive the MCPJam CLI (test, debug, and validate MCP servers)"),
+  cliVerb("spinifex", "drive the Spinifex CLI (spx — AWS-compatible cloud on your own hardware)"),
   cliVerb("trade", "look up tickers, inspect markets, and preview/place Alpaca orders"),
@@ -685,0 +686,0 @@ cliVerb("pwd", "print the current repo/location"),

src/tools.mjs

@@ -215,2 +215,33 @@ // Adjacent workflow CLIs moshcode can install and transparently invoke.
   },
+  spinifex: {
+    desc: "Spinifex — AWS-compatible cloud on your own hardware (EC2, EBS, S3, VPC, IAM)",
+    // The product is Spinifex; the binary it installs is `spx`. Same split as
+    // `secrets` → `logicsrc`: the moshcode command reads as the product name.
+    bin: "spx",
+    // https://docs.mulgadc.com/docs/install — the vendor script drops
+    // /usr/local/bin/spx, installs systemd units and scoped sudoers rules, and
+    // pulls QEMU/OVN/AWS CLI through apt, so it is Linux-only (Ubuntu 26.04 /
+    // Debian 13) and always escalates. It finds sudo itself, like tailscale's,
+    // so needsRoot only says a password prompt is coming — see primeEscalation.
+    //
+    // The script is bash (it uses bashisms and documents `| bash`), so `sh -c
+    // "curl … | sh"` would not do.
+    //
+    // INSTALL_SPINIFEX_SKIP_NEWGRP is the important part: on a TTY the
+    // installer finishes with `exec newgrp spinifex`, replacing itself with an
+    // interactive subshell to activate the new group. Under `moshcode install`
+    // that never returns — the operator lands in a subshell instead of back in
+    // the pit, and inside `moshcode update` it would park the rest of the plan
+    // behind a shell nobody asked for. Skipping it costs nothing a new login
+    // shell does not fix.
+    needsRoot: true,
+    install: {
+      cmd: "bash",
+      args: ["-c", "curl -fsSL https://install.mulgadc.com | INSTALL_SPINIFEX_SKIP_NEWGRP=1 bash"],
+    },
+    // Re-running the installer is Spinifex's own documented update path — it
+    // detects the existing install, replaces the binary, runs pending config
+    // migrations, and restarts the services. toolUpgradeSpec falls back to
+    // install, so there is deliberately no upgrade key.
+  },
 };
@@ -217,0 +248,0 @@

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1758501

0.25%

Lines of code

31391

0.1%

Number of lines in readme file

1508

3.22%

No dependency changes