moshcode - npm Package Compare versions
+68
-0
@@ -26,2 +26,4 @@ #!/bin/sh | ||
| # MOSHCODE_ALLOW_ROOT=1 install as root anyway (see below) | ||
| # MOSHCODE_NO_PROXY=1 skip the pinned-TLS proxy (https:// on a Moshpit | ||
| # name will not verify without it) | ||
| # | ||
@@ -45,2 +47,4 @@ # Do not install this with sudo. moshcode is a user-level CLI, and every path | ||
| PROXY_INSTALLER="${MOSHCODE_PROXY_INSTALLER:-https://raw.githubusercontent.com/profullstack/moshpit-proxy/main/install.sh}" | ||
| # ---- pretty output (acid-lime, matching the CLI) -------------------------- | ||
@@ -56,2 +60,5 @@ if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then | ||
| fail() { printf '%s✗%s %s\n' "$RED" "$RESET" "$*" >&2; exit 1; } | ||
| # Unlike fail(), does not exit: an optional component that did not install is | ||
| # not a reason to leave the CLI half-written. | ||
| warn() { printf '%s!%s %s\n' "$RED" "$RESET" "$*" >&2; } | ||
@@ -161,2 +168,62 @@ # ---- prerequisites -------------------------------------------------------- | ||
| # ---- the pinned-TLS proxy ------------------------------------------------- | ||
| # Without this, HTTPS on a Moshpit name cannot work. No public CA will ever sign | ||
| # for `.eggs`, so a name answers its origin's own self-signed leaf and a stock | ||
| # client refuses it — correctly. moshpit-proxy generates one local root and | ||
| # terminates TLS in the one language a browser accepts, which turns "trust this | ||
| # certificate" from a thing you do per name into a thing you do once. | ||
| # | ||
| # Installed here rather than left as a follow-up step because the alternative is | ||
| # `moshcode dns enable` finishing successfully, every name resolving, and every | ||
| # https:// URL still failing — which reads as broken, not as unfinished. | ||
| # | ||
| # This is the one part of the install that touches the system's trust store, so | ||
| # it is the one part with an opt-out: MOSHCODE_NO_PROXY=1 skips it entirely, and | ||
| # `moshpit-proxy install.sh --uninstall` undoes it later. It installs no DNS | ||
| # routing and starts no resolver -- `moshcode dns enable` stays a thing a person | ||
| # types deliberately. | ||
| install_proxy() { | ||
| if [ -n "${MOSHCODE_NO_PROXY:-}" ]; then | ||
| info "skipping the pinned-TLS proxy (MOSHCODE_NO_PROXY is set) — https:// on a Moshpit name will not verify" | ||
| return 0 | ||
| fi | ||
| info "installing the pinned-TLS proxy (so https:// on a Moshpit name verifies)" | ||
| # Downloaded first and run second, rather than `curl … | sh`. | ||
| # | ||
| # A pipeline reports the exit status of its LAST command, and a `sh` handed | ||
| # an empty stdin by a 404 exits 0 — so piping reports a successful install | ||
| # for a script that never arrived. Verified: pointed at a missing URL, the | ||
| # piped form printed "✓ pinned-TLS proxy installed, local root trusted". | ||
| _proxy_sh="$(mktemp 2>/dev/null)" || { | ||
| warn "could not create a temp file for the pinned-TLS proxy installer — skipping" | ||
| return 0 | ||
| } | ||
| if ! curl -fsSL "$PROXY_INSTALLER" -o "$_proxy_sh" 2>/dev/null; then | ||
| rm -f "$_proxy_sh" | ||
| warn "could not download the pinned-TLS proxy — moshcode is fine, but https:// on a Moshpit name will not verify" | ||
| warn " retry: curl -fsSL $PROXY_INSTALLER | sh" | ||
| return 0 | ||
| fi | ||
| # `--yes` because this installer is normally reached through a pipe, where | ||
| # there is no terminal to answer its prompt on. Announced above rather than | ||
| # asked, and MOSHCODE_NO_PROXY is the opt-out. | ||
| if sh "$_proxy_sh" --yes >/dev/null 2>&1; then | ||
| ok "pinned-TLS proxy installed, local root trusted" | ||
| info " it covers .moshpit by default — for other endings:" | ||
| info " MOSHPIT_PROXY_TLDS=moshpit,eggs,hacker,2600" | ||
| info " undo just this: curl -fsSL $PROXY_INSTALLER | sh -s -- --uninstall" | ||
| else | ||
| # Never fatal. moshcode is a coding CLI first, and a machine that cannot | ||
| # finish an optional component still wants the CLI it asked for. Said out | ||
| # loud so it is not discovered later as a TLS error with no explanation. | ||
| warn "the pinned-TLS proxy did not install — moshcode is fine, but https:// on a Moshpit name will not verify" | ||
| warn " retry: curl -fsSL $PROXY_INSTALLER | sh" | ||
| fi | ||
| rm -f "$_proxy_sh" | ||
| unset _proxy_sh | ||
| } | ||
| # ---- commands ------------------------------------------------------------- | ||
@@ -172,2 +239,3 @@ run_install() { | ||
| ensure_path | ||
| install_proxy | ||
| printf '\n%sdone.%s run:\n' "$ACID" "$RESET" | ||
@@ -174,0 +242,0 @@ printf ' moshcode # open the TUI shell\n' |
+1
-1
| { | ||
| "name": "moshcode", | ||
| "version": "0.80.0", | ||
| "version": "0.81.0", | ||
| "type": "module", | ||
@@ -5,0 +5,0 @@ "description": "moshcode \u2014 a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript", |
New alerts
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Found 3 instances
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Fixed alerts
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Found 3 instances
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Improved metrics
- Total package byte prevSize
2116510
0.17%