moshcode v0.13.3

What's Changed

• moshpit: publish the keys a name may present by @ralyodio in #137
• pit: claim a pasted list of endings by @ralyodio in #138
• dns: enable Moshpit names on the machine, on any OS by @ralyodio in #141
• pit: let a pasted line carry its own price and target by @ralyodio in #142
• Add Bash, Zsh, and Fish completions by @phucnguyen1707 in #140
• fix(moshscript): keep code in the result under --dry-run by @clawedassistant26 in #139
• pit: raise the paste ceiling to 1000 and stop on the clock, not a count by @ralyodio in #143
• pit: $2 a name, $5 an ending — no trailing cents by @ralyodio in #144
• pit: claim a pasted list in batches, not one round trip at a time by @ralyodio in #146
• pit: serve a Moshpit name at /n/ by @ralyodio in #145
• pit: let an ending be all digits by @ralyodio in #147
• pit: buy an unclaimed name from the page someone landed on by @ralyodio in #148
• pit: a parked name is a page, not a 404 by @ralyodio in #149
• moshcode: uninstall an engine or tool by @ralyodio in #150
• fix(completion): complete the uninstall command and its targets by @clawedassistant26 in #151
• pit: an ending can be bought and renewed by @ralyodio in #152
• chore(release): v0.13.3 by @ralyodio in #153

Full Changelog: v0.13.2...v0.13.3

v0.13.2 — turso where you left it

What's Changed

• fix(tools): find turso in ~/.turso instead of reporting it missing by @ralyodio in #135
• fix(tui): stop styling the agent-view notice as an error by @ralyodio in #134
• fix(runtime): deliver fire-and-forget notify() when the script throws by @clawedassistant26 in #133
• chore(release): v0.13.2 by @ralyodio in #136

Full Changelog: v0.13.1...v0.13.2

v0.13.1 — upgrades that actually upgrade

moshcode upgrade no longer leaves a target stranded when its own updater refuses.

opencode-family updaters decide how to update by recognising where the binary was installed. When they don't recognise the location they report Using method: unknown and stop — the same on every run, so the version never moves. The same opencode upgrade reports Using method: curl and succeeds where the install is one it knows, which is why this failed on one machine and worked on another.

• when a native updater fails, the target's installer runs instead — installers are idempotent and fetch the latest, which is already what an uninstalled target uses
• the fallback only exists where the updater is a different command, so it can never repeat the one that just failed; claude, codex and gemini are npm i -g and aren't retried
• it says when it falls back rather than retrying silently
• privacycode drops its native updater outright: it's opencode's, pointed at ~/.privacycode/bin, so it could never upgrade an install made by its own installer

v0.13.0 — moshcode dns

moshcode dns — resolve Moshpit names on the machine, not just in the browser.

The registry speaks HTTP, not DNS: pit.moshcode.sh answers /api/moshpit/resolve and nothing listens on port 53, so curl https://california.oranges/ failed on any server. A browser extension can't fix that — redirecting tabs isn't resolution.

moshcode dns tlds              # the TLDs claimed in the Pit
moshcode dns resolve <name>    # what a name resolves to, and why
moshcode dns start             # run the resolver
moshcode dns install [--write] # systemd-resolved / dnsmasq config

Claimed-but-unpointed names answer with the parking host, so they explain themselves instead of returning NXDOMAIN. A registry that is unreachable still returns NXDOMAIN — an outage must not silently point every Moshpit name on the machine at a parking page.

17 new tests including a real UDP round-trip; full suite 331 pass / 0 fail.

v0.12.3 — paste a block

Paste a block of commands into the session page. The send box was a one-line input, so anything multi-step had to be sent a line at a time — and pasting a block dumped it onto one line, which then ran as a single nonsense command.

• it's a textarea: paste grows it, enter runs, shift+enter makes a new line
• the split is server-side, one queued command per line, so it works with the CLI you already have — the pit takes exactly one line per prompt turn
• lines are stamped a millisecond apart, so a paste lands in the order you pasted it
• blank lines and the trailing newline of a copied block are dropped rather than fired as bare enters; 50 lines per paste

the pit — names can be bought under someone else's TLD, paid via CoinPay (#127); numeric hostname labels and numeric labels when registering are both accepted now (#119, #120)

v0.12.2 — web terminal

/sessions/:id is a real terminal now. It used to be a <div> fed by a hand-rolled ANSI translator that kept colour and dropped every other escape, so spinners, progress lines and anything the pit redrew in place either vanished or stacked up as duplicate text. It runs xterm.js over the raw stream instead — the bytes were always there, only the renderer was throwing them away.

• the CLI reports its tty size on register, on every flush and on resize; the page runs at exactly that geometry, so output no longer wraps at the wrong column
• selection and copy work
• typing anywhere on the terminal reaches the prompt; commands sent from the web are reported beside it rather than injected into the stream
• no size is sent when there is no tty to measure (piped runs, CI), and the page falls back to filling its box

Also in this release, since v0.12.1:

the pit — the Moshpit namespace lands on app.moshcode.sh: claim a TLD, register names under it, and reach it from the nav (#113, #117)

mirror — engine and tool output is captured through a real pseudo-terminal via script(1), so an engine that takes the terminal is finally visible in the mirror (#92); a split multi-byte character no longer corrupts the stream (#99); engine-only updates are sent (#109); the mirror subscribes before replaying its scrollback, so a chunk committed mid-read can't fall in the gap (#90)

console — a browser terminal on this box, gated by moshcode login (#93), with IPv6 ttyd targets (#111) and a malformed cookie no longer killing the gateway (#96)

tools — railway, gh, supabase, doppler, doctl, tailscale (#89) and the Turso CLI (#94); upgrade installs a missing target instead of running its updater (#112)

mcp — a known-server catalog, starting with Porkbun (#95)

sessions & approvals — command acknowledgements and the long-poll window are validated (#107, #115); device approvals are atomic (#98); approvals preserve the first resolution (#101); the sessions page shows the current credit balance (#103); SMS without a target is rejected (#105); a duplicate passkey registration no longer strands an account (#91)

v0.12.1 — MOTD ad

The startup banner now carries a CrawlProof MOTD block, fetched as text/plain and printed under the engine list.

• request goes out before the banner renders, capped at 1.5s, silent on any failure
• advertiser copy is re-sanitized locally (an escape sequence in a headline could repaint your terminal)
• 76 cols, so the click URL fits inside the box and still inside an 80-col terminal
• MOSHCODE_NO_ADS=1 opts out; MOSHCODE_AD_COLS overrides the width

v0.12.0 — live session mirror

See a running mosh instance from the browser, and type back into it.

app.moshcode.sh/sessions lists your connected instances; opening one streams what that pit is printing, in real time, with its colour intact. The send box runs a command in the live prompt.

• CLI registers on start, tees its output to the app in small batches, long-polls for web commands
• SSE stream replays scrollback first, so a page opened mid-run has context
• commands are claimed exactly once (the UPDATE is the lock)
• best-effort and opt-out: network errors are swallowed, only an interactive TTY registers, MOSHCODE_NO_MIRROR=1 disables it

Known limit: when an engine takes the terminal (/agents claude) it writes to the tty on its own fd, so the mirror shows the hand-off, not the engine's own screen.

Requires the app to run its new migration (005_sessions.sql).

v0.11.1 — login works over SSH

moshcode login / /login now picks the device-code flow automatically on SSH and headless shells.

The loopback flow listens on 127.0.0.1 on the machine running the CLI, then asks a browser to redirect there. Over SSH that browser is on a different machine, so its 127.0.0.1 is the laptop's — the auth code was minted fine but landed nowhere, and login always timed out.

• auto-detects SSH_CONNECTION/SSH_TTY, or Linux with no DISPLAY/WAYLAND_DISPLAY
• --browser (or MOSHCODE_LOGIN=browser) forces the old loopback flow
• --device (or MOSHCODE_LOGIN=device) still forces the code
• /login and /whoami are now listed in the TUI help

v0.11.0 — /secrets 🔐

Adds /secrets — wraps the logicsrc credential CLI so you can manage/view end-to-end-encrypted team secrets from moshcode (/secrets teams pull acme prod, secrets(...) in moshscript, moshcode install secrets).