Merge branch 'main' into feat/proxy-loopback

Two textual conflicts in src/dns.mjs, both additive: main's --trust-all
auto-trust and this branch's --proxy loopback mode touch the same deps
block and the same onQuery handler. Kept both — the flags are independent,
so proxy mode passes proxyAddress through while auto-trust still considers
each name that resolved to something of ours.

Also one conflict git could not see: main's template list --json test
(#284) asserts an exact template list, and this branch adds caddy-proxy.
Added it to the expectation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

README.md

@@ -45,6 +45,7 @@ or miss one that does. A test fails the build when it drifts.
 | `moshcode pwd` <br>`where` | system | show the current directory and git context |
 | `moshcode engines` | engines | list engines and installation status |
 | `moshcode tools` | tools | list workflow tools and installation status |
+| `moshcode trade` | tools | look up markets and trade through Alpaca |
 | `moshcode commands` | script | list built-in moshscript commands |
 | `moshcode completion` | extend | print a shell completion script |
 | `moshcode run` | script | run a moshscript |
@@ -61,6 +62,9 @@ moshcode install opencode   # install opencode (curl … | bash)
 moshcode install privacycode # curl -fsSL https://getprivacycode.com/install | sh
 moshcode install claude     # npm i -g @anthropic-ai/claude-code
 moshcode install codex      # npm i -g @openai/codex
+moshcode install kimi       # curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash
+moshcode install qwen       # npm i -g @qwen-code/qwen-code
+moshcode install deepseek   # npm i -g @serjm/deepseek-code
 ```
 
 ### Autonomous agents versus raw starts
@@ -76,6 +80,9 @@ moshcode agents opencode    # opencode agent list                          (agen
 moshcode agents privacycode # privacycode agent list                       (agent view)
 moshcode agents codex       # codex --dangerously-bypass-approvals-and-sandbox  (autonomous)
 moshcode agents gemini      # gemini --approval-mode=yolo                       (autonomous)
+moshcode agents kimi        # kimi --yolo                                       (autonomous)
+moshcode agents qwen        # qwen --approval-mode=yolo                         (autonomous)
+moshcode agents deepseek    # deepseek-code --turbo                             (autonomous)
 moshcode agents aider       # aider --yes-always                                (autonomous)
 ```
 
@@ -92,6 +99,21 @@ is shorthand for `moshcode start claude`. In the TUI, use `/agents <engine>` for
 autonomous mode or `/start <engine>` for raw mode. Running `moshcode agents` or
 `/agents` without an engine still lists engines and their install status.
 
+### Parallel pit tabs
+
+At the mosh prompt, `/new` opens and switches to another independent moshcode
+tab. Run `/agents <engine>` in each tab and switch between them with tmux's
+`Ctrl-b n`, `Ctrl-b p`, or `Ctrl-b <number>` keys. If moshcode is already inside
+tmux, `/new` adds a window to that session and respects its configured window
+keys. Otherwise the first `/new` opens an isolated two-tab workspace with those
+default keys and its tab bar at the bottom.
+
+Each tab is a separate moshcode process and provider CLIs still receive an
+ordinary inherited terminal. Moshcode does not intercept or reinterpret their
+input, output, full-screen UI, or provider-specific shortcuts. The feature
+requires `tmux`; without it `/new` reports that requirement and leaves the
+current pit untouched.
+
 The modes are not identical across providers. In particular, OpenCode `--auto`
 auto-approves permission requests but continues to enforce explicit deny rules.
 
@@ -154,6 +176,41 @@ native setup and authentication commands. CoinPay currently requires Node.js
 In the TUI, use `/tools`, `/ugig [args…]`, or `/coinpay [args…]`. The native CLI
 owns the terminal until it exits, then MoshCode returns to the pit.
 
+### Alpaca trading
+
+Alpaca is a workflow tool, not a coding engine. Install its official Go CLI,
+use `alpaca` for exact native passthrough, or use `trade` for the shorter market
+and order vocabulary:
+
+```sh
+moshcode install alpaca            # go install github.com/alpacahq/cli/cmd/alpaca@latest
+moshcode trade login               # Alpaca profile login; paper trading is the default
+moshcode trade ticker AAPL         # asset get --symbol-or-asset-id AAPL
+moshcode trade quote AAPL          # latest quote
+moshcode trade analysis AAPL       # quote/trade/bar snapshot for analysis
+moshcode trade watch               # list watchlists
+moshcode trade positions           # list open positions
+moshcode trade orders              # list open orders
+```
+
+`buy` and `sell` are safe previews unless `--submit` is explicit. Other Alpaca
+order flags pass through, including limit prices and its separate live-trading
+opt-in:
+
+```sh
+moshcode trade buy AAPL 1                          # adds --type market --dry-run
+moshcode trade buy AAPL 1 --type limit --limit-price 185
+moshcode trade buy AAPL --notional 100              # preview a $100 market buy
+moshcode trade buy AAPL 1 --submit                 # places the paper order
+moshcode trade raw data news --symbol AAPL         # any native Alpaca command
+moshcode alpaca order submit --help                # exact native passthrough
+```
+
+The same facade is `/trade …` in the pit and `trade(…)` in moshscript.
+Alpaca's CLI has no confirmation prompts; `--submit` intentionally removes
+MoshCode's preview guard. Live trading additionally requires Alpaca's `--live`
+opt-in or corresponding environment setting.
+
 ## Browser terminal (`moshcode console`)
 
 A real terminal in the browser — arrow keys, history, full-screen TUIs — because
@@ -216,7 +273,9 @@ moshcode mcp add porkbun          # expands to: npx -y @porkbunllc/mcp-server
 ```
 
 That registers it across every engine that supports MCP (claude, gemini, codex,
-opencode, privacycode) in one go.
+opencode, privacycode) in one go. Kimi is skipped with a reason: it runs MCP
+servers but has no command to register one from a script — add those in-session
+with its own `/mcp-config`, or in `~/.kimi-code/mcp.json`.
 
 The catalog is a convenience, never a gate — an explicit command always wins, so
 `moshcode mcp add porkbun -- node ./my-fork.js` runs your fork.
@@ -249,6 +308,7 @@ something to put behind it:
 
 ```sh
 moshcode template list                        # what there is
+moshcode template list --json                 # machine-readable template metadata
 moshcode template install bun-caddy-sqlite    # into the current directory
 moshcode template install caddy-static --into /srv/site
 moshcode template install owner/repo          # or a git URL, or a .tar.gz

bin/moshcode.mjs

@@ -15,6 +15,7 @@ import {
   runCmd,
 } from "../src/engines.mjs";
 import { TOOLS, toolList, toolStatus, resolveTool, openTool } from "../src/tools.mjs";
+import { tradeArgs, tradeUsage } from "../src/trade.mjs";
 import { runUpgrade } from "../src/upgrade.mjs";
 import { selfUpdateCommand } from "../src/selfupdate.mjs";
 import { describeUninstall, uninstallPlan } from "../src/uninstall.mjs";
@@ -317,6 +318,29 @@ async function main() {
     }
     return;
   }
+  if (cmd === "trade") {
+    const translated = tradeArgs(rest);
+    if (translated.usage) {
+      console.log(tradeUsage());
+      return;
+    }
+    if (translated.error) {
+      console.error(`${translated.error}\n\n${tradeUsage()}`);
+      process.exitCode = 1;
+      return;
+    }
+    const tool = TOOLS.alpaca;
+    const r = await openTool(tool, translated.args);
+    if (!r.ok) {
+      console.error(r.error?.code === "ENOENT"
+        ? `alpaca isn't installed (\`${tool.bin}\`). run: moshcode install alpaca`
+        : `launch failed: ${r.error?.message || r.error}`);
+      process.exitCode = 1;
+      return;
+    }
+    propagateExit(r.code, r.signal);
+    return;
+  }
   if (cmd === "console") {
     const code = await consoleCommand(rest);
     if (code) process.exitCode = code;
@@ -345,6 +369,7 @@ async function main() {
     const result = await runCmd(install.cmd, install.args);
     if (!result.ok) {
       console.error(`install failed: ${result.error?.message || result.error || "unknown error"}`);
+      if (result.error?.code === "ENOENT" && entry.installHelp) console.error(entry.installHelp);
       process.exitCode = 1;
       return;
     }
@@ -417,7 +442,7 @@ async function main() {
           return results.filter((r) => !r.ok).length ? 1 : 0;
         },
         write: (path, body) => fsp.writeFile(path, body),
-        runner: (cmd2, args2) => new Promise((res) => execFile(cmd2, args2, () => res({ ok: true }))),
+        runner: (cmd2, args2) => new Promise((res) => execFile(cmd2, args2, (err) => res({ ok: !err }))),
       })) || 0;
       return;
     }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.19.1",
+  "version": "0.22.1",
   "type": "module",
   "description": "moshcode — a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "bin": {

src/cli-schema.mjs

@@ -229,9 +229,15 @@ export const CORE_CLI_COMMANDS = [
     group: "hosting",
     description: "scaffold a stack for a Moshpit-hosted service",
     synopsis: [
-      ["moshcode template list", "what there is"],
+      ["moshcode template list [--json]", "what there is"],
       ["moshcode template install <name>", "write it here"],
     ],
+    flags: [
+      ["--into <dir>", "write somewhere other than the current directory", ""],
+      ["--force", "overwrite files that are already there", ""],
+      ["--dry-run", "show changes without writing anything", ""],
+      ["--json", "machine-readable template list", ""],
+    ],
     examples: [["moshcode template install bun-caddy-sqlite", ""]],
     seeAlso: ["site"],
   },
@@ -261,6 +267,21 @@ export const CORE_CLI_COMMANDS = [
     flags: [["--json", "machine-readable, and suppresses the trailing note", ""]],
     seeAlso: ["install"],
   },
+  {
+    name: "trade",
+    group: "tools",
+    description: "look up markets and trade through Alpaca",
+    synopsis: [["moshcode trade <verb> [args…]", "paper trading is Alpaca's default"]],
+    verbs: "TRADE_VERBS",
+    examples: [
+      ["moshcode trade ticker AAPL", "asset lookup"],
+      ["moshcode trade analysis AAPL", "quote/trade/bar snapshot"],
+      ["moshcode trade buy AAPL 1", "preview a market order"],
+      ["moshcode trade buy AAPL 1 --submit", "place it"],
+    ],
+    seeAlso: ["tools", "install"],
+    note: "buy/sell inject --dry-run unless --submit is present. Alpaca defaults to paper trading; live trading requires its separate --live opt-in.",
+  },
   {
     name: "commands",
     group: "script",
@@ -389,6 +410,35 @@ export const UPGRADE_TARGETS = [
   { name: "tools", description: "update all installed workflow tools" },
 ];
 
+export const TRADE_VERBS = [
+  { name: "ticker", description: "look up an asset by ticker", synopsis: [["moshcode trade ticker <symbol> [flags…]", ""]] },
+  { name: "quote", description: "get the latest quote", synopsis: [["moshcode trade quote <symbol> [flags…]", ""]] },
+  { name: "analysis", description: "get an analysis-ready market snapshot", synopsis: [["moshcode trade analysis <symbol> [flags…]", ""]] },
+  {
+    name: "buy", description: "preview or submit a buy order",
+    synopsis: [
+      ["moshcode trade buy <symbol> <qty> [alpaca flags…] [--submit]", "share quantity"],
+      ["moshcode trade buy <symbol> --notional <usd> [--submit]", "dollar amount"],
+    ],
+    flags: [["--submit", "place the order instead of injecting --dry-run", "preview"]],
+  },
+  {
+    name: "sell", description: "preview or submit a sell order",
+    synopsis: [
+      ["moshcode trade sell <symbol> <qty> [alpaca flags…] [--submit]", "share quantity"],
+      ["moshcode trade sell <symbol> --notional <usd> [--submit]", "dollar amount"],
+    ],
+    flags: [["--submit", "place the order instead of injecting --dry-run", "preview"]],
+  },
+  { name: "watch", description: "manage watchlists", synopsis: [["moshcode trade watch [list|create|get|add|remove|delete] [args…]", ""]] },
+  { name: "positions", description: "list, inspect, or close positions", synopsis: [["moshcode trade positions [verb] [args…]", "default: list"]] },
+  { name: "orders", description: "list, inspect, replace, or cancel orders", synopsis: [["moshcode trade orders [verb] [args…]", "default: list"]] },
+  { name: "account", description: "show account details", synopsis: [["moshcode trade account [args…]", ""]] },
+  { name: "login", description: "authenticate an Alpaca profile", synopsis: [["moshcode trade login [alpaca profile flags…]", "paper by default"]] },
+  { name: "clock", description: "show market status and next open/close", synopsis: [["moshcode trade clock [args…]", ""]] },
+  { name: "raw", description: "invoke the native Alpaca command tree", synopsis: [["moshcode trade raw <alpaca args…>", ""]] },
+];
+
 /**
  * `dns` sub-verbs.
  *
@@ -406,6 +456,7 @@ export const DNS_VERBS = [
   { name: "service", description: "install or remove the background service" },
   { name: "tlds", description: "list the endings claimed in the Pit" },
   { name: "resolve", description: "what a name resolves to, and why" },
+  { name: "trust", description: "trust one name's certificate, after checking it against the registry pin" },
 ];
 
 /** Sub-verb tables, by the name a command's `verbs` field refers to. */
@@ -414,6 +465,7 @@ export const VERB_TABLES = {
   SKILL_VERBS,
   UPGRADE_TARGETS,
   DNS_VERBS,
+  TRADE_VERBS,
 };
 
 /**
@@ -430,12 +482,16 @@ export const VERB_TABLES = {
  * than a second, thinner copy that drifts.
  */
 export const PIT_COMMANDS = [
+  { name: "new", pitOnly: true,
+    description: "open and switch to another moshcode tab" },
   { name: "agents", aliases: ["agent", "engines"], args: "[name]", cli: "agents",
     description: "list engines, or launch one autonomously" },
   { name: "start", args: "<engine> [args…]", cli: "start",
     description: "raw launch; inject no engine arguments" },
   { name: "tools", args: "[name] [args…]", cli: "tools",
     description: "list workflow tools, or run one" },
+  { name: "trade", args: "<verb> [args…]", cli: "trade",
+    description: "look up markets and preview/place Alpaca orders" },
   { name: "install", args: "<engine|tool>", cli: "install",
     description: "install an engine or workflow tool" },
   { name: "upgrade", aliases: ["update"], args: "[name…]", cli: "upgrade",

src/commands.mjs

@@ -248,6 +248,8 @@ const COMMANDS = [
   cliVerb("doctl", "drive the DigitalOcean CLI (droplets, apps, databases)"),
   cliVerb("turso", "drive the Turso CLI (auth, databases, replicas)"),
   cliVerb("tailscale", "drive the Tailscale CLI (mesh VPN: up, status, ssh, serve)"),
+  cliVerb("alpaca", "drive the native Alpaca trading CLI"),
+  cliVerb("trade", "look up tickers, inspect markets, and preview/place Alpaca orders"),
   cliVerb("pwd", "print the current repo/location"),
 ];