v0.26.0 — the question before the trade

Two features that add commands rather than change them, hence a minor bump.

moshcode ticker / /ticker — the question before the trade

trade could quote a price and place an order. Nothing answered is this worth buying?

moshcode ticker NVDA               # score, technicals, fundamentals, thesis, signals, sources
moshcode ticker lookup rivian      # company name → RIVN
moshcode ticker signals AAPL       # what was said, quoted and sourced
moshcode ticker search "data center"
moshcode ticker discover fusion    # ranked watchlist

A bare symbol is the report, so the common case stays the shortest thing to type. --json on any verb returns the raw document. Backed by advis0r.com — every route used is public, read-only and unauthenticated, so there is no login verb, no write path, and no credential held.

Two rules the renderers enforce structurally rather than merely document: a stored snapshot always prints its reportGeneratedAt, whether the price is delayed and which feed produced it — a stale price dressed as a live one is the failure mode here that costs money — and the API's own disclaimer travels with the data. A model-written thesis is labelled with its provider and model; a deterministic one is labelled offline.

A Claude Code plugin marketplace

moshcode fanned MCP servers and Agent Skills out across engines but published none of its own commands. It does now.

moshcode plugin install

Adds the marketplace and installs ticker@moshcode, which provides /ticker, /signals, /research, /lookup, /reports and /discover inside the engine. The fan-out follows the same contract as skills: every engine appears in the summary, and the ones with no plugin primitive say so rather than being silently omitted.

Posting from the pit

/bluesky and /nostr post from the pit, with credentials resolved the way every other moshcode integration resolves them.

Note for anyone who installed the plugin already

install.sh serves the latest release tarball, not main. Before this release the installed binary reported unknown command "ticker", and the plugin's slash commands fell back to calling the API with curl — working, but skipping the rendering the verb exists to do. Update to get the real path:

curl -fsSL https://moshcoding.com/install.sh | sh -s -- update

Full: #318 · #317 · #319

v0.25.1 — a session, not a listing

/agents opencode and /agents privacycode now open a live session.

Both engines were wired to agentsView: ["agent", "list"], so /agents ran <engine> agent list — a one-shot, machine-readable command that prints every agent's permission config and exits straight back to the pit. On opencode 1.18.x that output is raw JSON, so it read as a wall of errors followed by a crash.

/agents promises to hand the terminal to a live session, so neither engine carries an agentsView any more: both fall through to --auto, which opens the TUI — where tab reaches the agent list anyway.

Both also declare their installer bin directories (~/.opencode/bin, ~/.privacycode/bin). Those installers only append to a shell rc, so the moshcode process that ran the installer reported the engine missing until the next shell — the same bridge kimi already had.

Full: #315

v0.25.0 — an answer a script can read

Account status as JSON

• moshcode whoami --json prints the current session as machine-readable JSON instead of prose.
• The status field distinguishes the cases that matter to a script — logged in, not_logged_in, expired, unverified — rather than making one parse a sentence to find out which it is.
• Shell completion offers the flag, and moshcode help whoami documents it.

$ moshcode whoami --json
{
  "status": "not_logged_in",
  "verified": false,
  "api": "https://app.moshcode.sh",
  "user": null
}

Packaging

• bin paths are written the way npm normalizes them, so publishing no longer warns that the entry points were "invalid and removed". They never were — npm was rewriting them and shipping working binaries — but the warning read like a broken package.

Install is unchanged: curl -fsSL https://moshcoding.com/install.sh | sh, or npm i -g moshcode.

v0.24.3 — no credential at all

Nothing new to install

Nothing that ships changed since v0.24.0. This closes out the release plumbing.

What it proves

Publishing now authenticates by trusted publishing: npm trades the short-lived token GitHub mints for this one workflow run for permission to publish. There is no long-lived credential in the repository to leak, rotate or forget — and the provenance attestation tying each tarball to this repository and build is generated automatically.

The path runs with nobody in it: publishing a release triggers a workflow that runs the tests, checks the tag against package.json, skips anything already on the registry, publishes, and confirms the registry has it.

Install is unchanged: curl -fsSL https://moshcoding.com/install.sh | sh, or npm i -g moshcode.

v0.24.2 — published by the pipeline, verifiably

Nothing new to install

Nothing that ships changed since v0.24.0. This closes out the release plumbing.

What was wrong

package.json carried no repository field. npm checks a provenance attestation's source repository against that field and refuses the tarball when they disagree — and an empty value disagrees with everything, so the v0.24.1 publish was rejected with E422 after signing successfully. It had never surfaced, because v0.24.0 was published by hand without provenance to verify.

• repository, homepage and bugs are now set.
• v0.24.1 is deliberately absent from npm: provenance ties a tarball to the commit it was built from, and publishing it from the fix commit would have left an attestation pointing at a commit that is not its tag.

What this release proves

The path now runs end to end without a person in it: publishing a release triggers a workflow that runs the tests, checks the tag against package.json, skips anything already on the registry, publishes, and confirms the registry has it — with a provenance attestation tying the tarball to this repository and this build.

Install is unchanged: curl -fsSL https://moshcoding.com/install.sh | sh, or npm i -g moshcode.

v0.24.1 — the release that publishes itself

Nothing new to install

Nothing that ships changed. The only commits since v0.24.0 are the publish workflow, and .github is not part of the published package — the tarball is byte-identical to v0.24.0 apart from its version.

What it is for

This is the first release to travel the whole path on its own: a published release now triggers a workflow that runs the tests, checks the tag against package.json, and publishes to npm over trusted publishing (OIDC) — no stored credential, with provenance attached automatically.

Up to now npm was a second channel updated by hand, which is the kind of channel that quietly serves an old version forever. From here it keeps step with the releases.

Install is unchanged: curl -fsSL https://moshcoding.com/install.sh | sh, or npm i -g moshcode.

v0.24.0 — names under a name

Third-level Moshpit names

• www.chovy.hacker now resolves. It is asked of the registry as written, and a name the registry does not hold falls back to the owner's published *.chovy.hacker wildcard.
• A sub-name that misses both is NXDOMAIN rather than parked. Parking exists to say a name is for sale, and a name under someone else's name is not — parking it would advertise their subdomains to anyone who guessed.
• * is a label only whole and only leftmost: f*.chovy.hacker and foo.*.hacker are not names the registry can be asked about.
• Four labels remain a shape the registry cannot hold, and forwarding is unchanged — the bridge still gates on the ending, so www.google.com is still your normal nameserver's to answer.
• moshcode dns resolve now has something to print for a sub-name that exists nowhere, instead of failing with a type error over the top of the answer.

This syncs the vendored DNS bridge with @moshcoder/moshpit-dns 0.5.0. The drift test that guards the copy had been pinned two releases behind, so it was green while the two had diverged; it now compares against the current package.

Also

• --proxy refuses a host name instead of quietly answering NODATA for every live name.
• Agent status can be printed as JSON.

Everything outside those paths is unchanged.

v0.23.0 — every live name behind the proxy

A certificate a stock client will accept

• moshcode dns start --proxy answers every live Moshpit name with the local pinned-TLS proxy instead of the name's origin.
• The proxy reads the SNI, checks the origin's key against the registry pin, and re-signs with a root this machine generated — the only way a stock browser can be told the result, since no CA will ever sign for a Moshpit name.
• Previously the proxy could sit on loopback with nothing routed to it, so every name still arrived as a self-signed certificate no matter what was installed.
• --proxy probes 127.0.0.1 and ::1 by default; --proxy <host> probes only the host you name.
• It refuses to start when nothing is listening on 443, rather than pointing every name on the machine at a closed port and turning a certificate problem into a total outage.
• Reachability is rechecked rather than remembered: a proxy that dies after the resolver started is the same outage as one that was never running.
• A proxy that speaks only one address family answers NODATA for the other, not a fabricated address that would refuse the connection.
• Parked names still reach the parking page. They have no origin and no published pin, so handing one to the proxy would turn "this name is for sale" into a TLS error.

Also

• New caddy-proxy example template: Caddyfile, README, and a systemd unit for putting a Moshpit name in front of a local service.

Requires moshpit-proxy listening on 443. Everything outside --proxy is unchanged.

v0.22.1 — parallel pits

Parallel moshcode tabs

• Type /new at the mosh prompt to open an independent moshcode tab and switch to it.
• Run /agents kimi (or any provider) in multiple tabs and switch between sessions without exiting either CLI.
• Outside tmux, moshcode creates an isolated two-tab workspace with a bottom tab bar and predictable Ctrl-b n, Ctrl-b p, and Ctrl-b 1/2 controls.
• Inside tmux, /new adds a window to the current session and respects its configured window keys.
• Each tab remains a separate process on a real PTY, preserving native provider input, output, full-screen UI, signals, and shortcuts.
• Failed private-workspace attachments now clean up their tmux server instead of leaving background pits behind.

Requires tmux for /new; all existing non-tab CLI behavior is unchanged.

v0.22.0 — Alpaca in the pit

Alpaca trading workflows

• Install the official Alpaca CLI with moshcode install alpaca; upgrade and uninstall use the same workflow-tool lifecycle.
• Use moshcode trade, TUI /trade, or moshscript trade() for ticker lookup, quotes, snapshot analysis, positions, orders, account details, and watchlists.
• Preview buy and sell orders safely by default; submission requires an explicit --submit, with quantity and notional order support.
• Drop to the native client with moshcode alpaca or TUI /alpaca whenever the facade is not enough.
• Shell completion, generated help, README documentation, missing-Go diagnostics, and real Alpaca CLI compatibility coverage are included.

Authenticate with moshcode trade login before using account endpoints. Alpaca profile selection still controls paper versus live trading.