Skip to content

fix(install): resolve tools by the name people actually say - #528

Merged
ralyodio merged 1 commit into
mainfrom
worktree-install-tool-aliases
Sep 22, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-install-tool-aliases

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

/install profullstack answered:

mosh ▸ /install profullstack
✗ unknown engine or tool "profullstack"

The set is published under the Profullstack name and installs from
github.com/profullstack/cli-tools, so that is the first thing anyone types —
but the registry key is cli-tools, and it is the one key whose name mentions
neither the brand nor any binary it provides.

The fix

Engines have had ENGINE_ALIASES for exactly this since /agents cc. Tools
never got the equivalent, so resolveTool was exact-match only. This adds
TOOL_ALIASES in the same shape and teaches resolveTool to consult it —
which fixes every surface at once, because the pit's /install and
/uninstall and the CLI's moshcode install all already route through
resolveInstallable.

typed resolves to
profullstack, profullstack/cli-tools, clitools, tools cli-tools
blog-post, domainfree, gh-prs cli-tools
bufferoverride, buffer-override bo
compute c0mpute
eleven, im, do, … their key

The symlinked binaries are in there because someone who has only ever run
blog-post has no reason to know a dispatcher is what installs it.

The pit's error was also a dead end

moshcode install <x> prints the full engine and tool roster on a miss. The
pit printed one line and stopped. It now points somewhere:

mosh ▸ /install crawlprof
✗ unknown engine or tool "crawlprof"
· did you mean `crawlproof`?

suggestTargets stays quiet for an unrelated word rather than offering a
confusing near miss, and falls back to "try /engines or /tools".

Tests

Six new cases in test/tools.test.mjs, including one that walks every alias
and asserts it points at a real tool and shadows no existing key — so a future
rename cannot leave a dangling alias behind. Own-property lookup is kept, so
__proto__ and constructor still resolve to nothing.

node --test "test/*.test.mjs"2511 pass, 0 fail, 4 skipped. (The
apps/pwa suites fail on this machine for the usual missing @libsql/client
— unrelated to these files.)

🤖 Generated with Claude Code

`/install profullstack` answered `unknown engine or tool "profullstack"`.
The set is published under the Profullstack name and installs from
github.com/profullstack/cli-tools, so that is the first thing anyone types --
but the registry key is `cli-tools`, and it is the one key whose name mentions
neither the brand nor a binary it provides.

Engines have had ENGINE_ALIASES for exactly this since `/agents cc`. Tools
never got the equivalent, so resolveTool was exact-match only. This adds
TOOL_ALIASES in the same shape and teaches resolveTool to consult it, which
fixes every surface at once -- the pit's /install and /uninstall and the CLI's
`moshcode install` all already route through resolveInstallable.

Aliased: profullstack (+ the binaries the set symlinks, since someone who has
only ever run blog-post has no reason to know the dispatcher installs it),
bufferoverride -> bo, compute -> c0mpute, and the handful of other spellings
that differ from their key. A test asserts every alias points at a real tool
and shadows no existing key, and own-property lookup is kept so `__proto__`
still resolves to nothing.

Also: the pit's unknown-target line was a dead end. `moshcode install <x>`
prints the full engine and tool roster on a miss, but the pit printed one line
and stopped. It now suggests the nearest names, or points at /engines and
/tools when nothing is close. suggestTargets stays quiet for an unrelated word
rather than offering a confusing near miss.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 3 file(s) this pull request changes.

Nothing in the files this pull request changes.

101 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 82 | **LOW**: 11

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928

…and 81 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit b5ff5e0 into main Sep 22, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant