Skip to content

Add Coral to the workflow tool registry - #390

Merged
ralyodio merged 1 commit into
mainfrom
worktree-coral-tool
Aug 14, 2026
Merged

Add Coral to the workflow tool registry#390
ralyodio merged 1 commit into
mainfrom
worktree-coral-tool

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds Coral to the workflow tool registry, so moshcode install coral (and /install coral in the pit) runs the vendor's official script:

curl -fsSL https://withcoral.com/install.sh | bash

Coral is a read-only SQL layer over APIs, databases, and internal systems — one connection an agent can query across sources.

What changed

  • src/tools.mjscoral entry: bin: "coral", install via the official script through bash.
  • src/commands.mjscliVerb("coral", …), so moshcode coral sql "…" passes straight through like every other tool.
  • README.md — install list + moshscript verb table.
  • test/tools.test.mjs — coral joins the install-script delegation loop, plus a registry test asserting the spec and the upgrade fallback.

Notes

  • No binDirs. The installer drops the binary in $HOME/.local/bin (overridable via CORAL_INSTALL_DIR) — the same dir gh/supabase/doctl land in, which is already assumed on PATH.
  • No upgrade key. Coral ships no self-updater and documents re-running the installer as the upgrade path for a direct install, which is exactly what toolUpgradeSpec falls back to. The new test asserts upgrade === undefined so adding one later is a deliberate change.
  • | bash, not | sh. The script is POSIX sh, but withcoral.com documents the bash pipeline, so that is what we run.

The pit help roster and moshcode install usage are derived from TOOLS, so both picked coral up with no further edits.

Verification

  • Full suite: 1697 pass, 0 fail, 229 skipped (pre-existing).
  • moshcode tools○ coral Coral — read-only SQL across your APIs, databases, and internal systems
  • moshcode install usage and moshcode help both list coral.
  • moshcode coral sql "SELECT 1"coral isn't installed (`coral`). run: moshcode install coral

🤖 Generated with Claude Code

Coral is a read-only SQL layer over APIs, databases, and internal
systems, so `moshcode install coral` runs the vendor's official script
and `/coral` passes arguments straight through like the other tools.

The installer resolves the latest GitHub release, verifies its sha256,
and drops the binary in ~/.local/bin — the same dir gh/supabase/doctl
land in, so no binDirs entry is needed. Coral ships no self-updater and
documents re-running the script as the upgrade path for a direct
install, which is what toolUpgradeSpec already falls back to.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

97 finding(s)

HIGH/CRITICAL: 5 | MEDIUM: 41 | LOW: 51

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:79
HIGH sh-remote-script-execution install.sh:83
HIGH tls-verification-disabled src/dns.mjs:741
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:61
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:75
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:101
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:265
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:269
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:314
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:499
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:675
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:677
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:736
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:782
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:852
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:955
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1063
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1199
MEDIUM js-unescaped-html-sink apps/pwa/src/routes/moshpit.mjs:1419
MEDIUM js-timing-unsafe-mac-compare apps/pwa/src/routes/settings-sync.mjs:192
MEDIUM js-dynamic-code-execution apps/pwa/test/apikey-mask.test.mjs:129
MEDIUM sql-template-interpolation apps/pwa/test/credits-webhook-event-match.test.mjs:111
MEDIUM sql-template-interpolation apps/pwa/test/credits-webhook-event-match.test.mjs:131
MEDIUM sql-template-interpolation apps/pwa/test/moshpit-terms.test.mjs:192
MEDIUM sql-string-concatenation src/cli-schema.mjs:128
MEDIUM sql-string-concatenation src/cli-schema.mjs:417
MEDIUM sql-string-concatenation src/cli-schema.mjs:543
MEDIUM js-timing-unsafe-mac-compare src/settings-sync.mjs:325
MEDIUM insecure-temp-file test/dns-disable-restore.test.mjs:93
MEDIUM insecure-temp-file test/dns-disable-restore.test.mjs:310
MEDIUM insecure-temp-file test/news.test.mjs:649
MEDIUM insecure-temp-file test/plugins.test.mjs:152
MEDIUM insecure-temp-file test/pty.test.mjs:28
MEDIUM insecure-temp-file test/pty.test.mjs:31
MEDIUM insecure-temp-file test/pty.test.mjs:40
MEDIUM insecure-temp-file test/pty.test.mjs:42
MEDIUM insecure-temp-file test/pty.test.mjs:47
MEDIUM insecure-temp-file test/pty.test.mjs:48
MEDIUM insecure-temp-file test/pty.test.mjs:49
MEDIUM insecure-temp-file test/tabs.test.mjs:8
MEDIUM insecure-temp-file test/tabs.test.mjs:13
MEDIUM insecure-temp-file test/tabs.test.mjs:14
MEDIUM insecure-temp-file test/tabs.test.mjs:22
MEDIUM insecure-temp-file test/trust.test.mjs:240
LOW secret-generic-credential apps/pwa/test/apikey-bearer-scheme.test.mjs:30
LOW secret-generic-credential apps/pwa/test/apikey-mask.test.mjs:38
LOW secret-generic-credential apps/pwa/test/apikey-reveal.test.mjs:35
LOW secret-generic-credential apps/pwa/test/approvals-context.test.mjs:28

…and 47 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit a3b396b into main Aug 14, 2026
4 checks passed
@ralyodio ralyodio mentioned this pull request Aug 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant