Skip to content

docs: generate README's command table from the schema (PRD 0006 R13) - #260

Merged
ralyodio merged 2 commits into
mainfrom
feat/readme-drift
Aug 3, 2026
Merged

docs: generate README's command table from the schema (PRD 0006 R13)#260
ralyodio merged 2 commits into
mainfrom
feat/readme-drift

Conversation

@ralyodio

@ralyodio ralyodio commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Follows #257 (CLI help) and #258 (the pit's /help). Same drift problem, third surface.

The problem

The README described the CLI from memory. Nothing connected its command listings to the table the dispatcher actually reads, so a renamed verb stayed documented and a new one stayed invisible — exactly the drift that had already happened inside moshcode help itself.

Generated, not checked

R13 offers either "checked against the schema by a test" or "generated from it via moshcode help --markdown". I did the generator, because a checker tells you the README is wrong and a generator makes it right.

The table lives between <!-- COMMANDS:START --> / <!-- COMMANDS:END --> markers — the same convention this repo already uses for the PRD index, so it's one people here already know.

Three tests, both directions

  1. The table is regenerated and compared. Adding a verb without regenerating fails with the command that fixes it in the assertion message.
  2. Every command named in the table resolves in the schema.
  3. Every moshcode <verb> invoked in a fenced code block anywhere in the README is a real command, engine or tool — this is the one that catches a rename, since the examples are scattered across 480 lines.

Test 3 is scoped to fenced blocks deliberately: the prose contains sentences like "moshcode warns you" and "moshcode doesn't reinvent the agent", and a grep that can't tell those from invocations is a test nobody trusts and everyone eventually deletes.

Verified the guard bites

I added a fake brandnewverb to the schema without regenerating, and confirmed the suite fails:

✖ README's command table is generated, and current
  AssertionError: README's command table is stale — regenerate it with `moshcode help --markdown`

Then restored the schema — the only change to cli-schema.mjs in this PR is documenting the new --markdown flag.

Tests

4 new (32 in test/help.test.mjs). Full suite: 1089 tests, 877 pass, 0 fail.

Remaining from PRD 0006, all P2: R14 (moshscript verb help — moshcode help ai), R15 (NO_COLOR), R16 (completing help topics).

🤖 Generated with Claude Code

The README described the CLI from memory. Nothing connected its command
listings to the table the dispatcher actually reads, so a renamed verb
stayed documented and a new one stayed invisible — the same drift that had
already happened inside `moshcode help` itself.

Generated rather than checked, which R13 offers as the alternative and is
the better half of it: a checker tells you the README is wrong, a generator
makes it right. `moshcode help --markdown` emits the table, and it goes
between markers in README.md exactly like the PRD index this repo already
maintains, so the convention is one people here already know.

Three tests, in both directions:

  - the table is regenerated and compared, so adding a verb without
    regenerating fails with the command that fixes it;
  - every command named in the table resolves in the schema;
  - every `moshcode <verb>` invoked in a fenced code block anywhere in the
    README is a real command, engine or tool. Scoped to fenced blocks
    because the prose also contains sentences like "moshcode warns you",
    and a grep that cannot tell those apart is a test nobody trusts.

Verified the guard bites: adding a command to the schema without
regenerating fails the suite, and the failure names `moshcode help
--markdown` as the fix.

1089 tests, 877 pass, 0 fail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

vu1nz Security Review

NOT RUNANTHROPIC_API_KEY was not found in the ENV_FILE secret, so no review was performed. This is not a clean result; this diff was not examined.

Add ANTHROPIC_API_KEY=… to the repository's ENV_FILE secret to enable the review.

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

87 finding(s)

HIGH/CRITICAL: 50 | MEDIUM: 37

Severity Rule Location
HIGH manifest-typosquat apps/pwa/package.json:19
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH secret-generic-credential apps/pwa/test/apikey-bearer-scheme.test.mjs:30
HIGH secret-generic-credential apps/pwa/test/apikey-mask.test.mjs:38
HIGH secret-generic-credential apps/pwa/test/apikey-reveal.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/approvals-context.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/approvals-credits.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/approvals-notify.test.mjs:26
HIGH secret-generic-credential apps/pwa/test/approvals-resolve-race.test.mjs:20
HIGH secret-generic-credential apps/pwa/test/auth-form-email.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/auth-form-email.test.mjs:33
HIGH secret-generic-credential apps/pwa/test/auth-page-error.test.mjs:36
HIGH secret-generic-credential apps/pwa/test/cli-device-token.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/cli-pages-balance.test.mjs:32
HIGH secret-generic-credential apps/pwa/test/cli-token.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/credits-pack.test.mjs:51
HIGH secret-generic-credential apps/pwa/test/credits-webhook-event-match.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/credits-webhook.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/csrf-input-escaping.test.mjs:31
HIGH secret-generic-credential apps/pwa/test/csrf-input-escaping.test.mjs:101
HIGH secret-generic-credential apps/pwa/test/logout-csrf.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/moshpit-api-key.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-bulk-claim.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-claim-full-name.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/moshpit-crawlable.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-ending-page.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-pins.test.mjs:22
HIGH secret-generic-credential apps/pwa/test/moshpit-pit-page.test.mjs:33
HIGH secret-generic-credential apps/pwa/test/moshpit-records-page.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-records.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-registry.test.mjs:20
HIGH secret-generic-credential apps/pwa/test/moshpit-related-endings.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-sales.test.mjs:16
HIGH secret-generic-credential apps/pwa/test/moshpit-search.test.mjs:74
HIGH secret-generic-credential apps/pwa/test/moshpit-terms.test.mjs:19
HIGH secret-generic-credential apps/pwa/test/moshpit-tlds-pagination.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/passkey-register-duplicate.test.mjs:38
HIGH secret-generic-credential apps/pwa/test/require-auth-next.test.mjs:31
HIGH secret-generic-credential apps/pwa/test/require-auth-next.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/sessions-output-seq.test.mjs:30
HIGH secret-generic-credential apps/pwa/test/sessions-paste.test.mjs:24
HIGH secret-generic-credential apps/pwa/test/sessions-stream-replay.test.mjs:34
HIGH secret-generic-credential apps/pwa/test/sessions.test.mjs:24
HIGH secret-generic-credential apps/pwa/test/signature.test.mjs:6
HIGH secret-generic-credential test/auth.test.mjs:13
HIGH secret-generic-credential test/auth.test.mjs:63
HIGH secret-generic-credential test/console-cookie-malformed.test.mjs:15
HIGH secret-generic-credential test/console.test.mjs:12
HIGH secret-generic-credential test/mirror.test.mjs:37
HIGH secret-generic-credential test/mirror.test.mjs:77

…and 37 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

#263)

The tail of PRD 0006 — R14, R15, R16.

R14. `moshcode help ask` answered "no help for ask". `ask()` is as much
part of the interface as `moshcode prd`, but the vocabulary lives in a
registry help had never been introduced to. Verbs now carry an optional
`usage` — `ai(prompt, { engine })`, `ask(...prompt)` — and help renders it
with the summary and a note that this one is called from a .mosh file, not
a shell. `usage` stays optional, so a verb registered by a host that has
not declared one still renders as `name(…)`.

cliVerb() derives its own signature rather than repeating it twenty times:
every CLI verb forwards its arguments to `moshcode <name>`, so adding a
line to the vocabulary documents it.

R15 turned out to be already true and is now nailed down. src/ui.mjs
gates colour on `NO_COLOR == null && process.stdout.isTTY`, so both the CLI
and the pit already emit plain text to a pipe. Three tests keep it that
way, including one for the pit — which needs spawnSync rather than the
execFile helper the rest of the file uses, because the pit reads stdin and
execFile has no way to supply it. Nothing paginates.

R16. `moshcode help <tab>` now completes topics, in all four shells. The
list is what help itself accepts — commands, engines, tools and moshscript
verbs — so tab-completion and help cannot disagree about what is
answerable. A test asserts exactly that: every offered topic resolves.

1099 tests, 887 pass, 0 fail.

That closes PRD 0006. R1–R16 are implemented across #257, #258, #260 and
this.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@ralyodio
ralyodio merged commit fddd559 into main Aug 3, 2026
5 checks passed
@ralyodio
ralyodio deleted the feat/readme-drift branch August 3, 2026 13:59
@ralyodio ralyodio mentioned this pull request Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant