Skip to content

fix(installer): install moshcode's runtime dependencies after unpacking - #116

Merged
ralyodio merged 1 commit into
masterfrom
fix/installer-runtime-deps
Sep 13, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/installer-runtime-deps

Conversation

@ralyodio

Copy link
Copy Markdown
Collaborator

moshcode stopped being dependency-free in 0.96.0 (@profullstack/synconfig). This installer unpacks the source tarball and stops, so every install through moshcoding.com/install.sh since then produced a CLI that died on its first import: Cannot find package '@profullstack/synconfig'.

After the package is in place, read package.json with node (grep would match "devDependencies") and, when it lists runtime dependencies, run npm install --omit=dev in the package dir. A missing npm or a failed install fails loudly instead of leaving a CLI that cannot start. Same fix as moshcoder/moshcode for its own install.sh.

🤖 Generated with Claude Code

https://claude.ai/code/session_014HMV1QDcVY1xiaWWrZQM4S

moshcode stopped being dependency-free in 0.96.0 (@profullstack/synconfig),
and this installer unpacks the source tarball and stops, so every install
through moshcoding.com/install.sh since then produced a CLI that died on its
first import: `Cannot find package '@profullstack/synconfig'`.

After the package is in place, read package.json with node (grep would match
"devDependencies") and, when it lists runtime dependencies, run
`npm install --omit=dev` in the package dir. A missing npm or a failed
install fails the install loudly rather than leaving a CLI that cannot start.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014HMV1QDcVY1xiaWWrZQM4S
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

20 finding(s)

HIGH/CRITICAL: 3 | MEDIUM: 13 | LOW: 4

Severity Rule Location
HIGH sh-remote-script-execution public/install.sh:294
HIGH sh-remote-script-execution public/install.sh:297
HIGH sh-remote-script-execution public/install.sh:424
MEDIUM js-open-redirect app/dashboard/[[...tab]]/page.tsx:67
MEDIUM js-open-redirect app/signup/page.tsx:38
MEDIUM js-open-redirect components/PitSearch.tsx:118
MEDIUM js-unescaped-html-sink components/Tenant.tsx:21
MEDIUM js-unescaped-html-sink components/Tenant.tsx:22
MEDIUM js-unescaped-html-sink components/Tenant.tsx:62
MEDIUM js-unescaped-html-sink components/Tenant.tsx:136
MEDIUM sql-template-interpolation lib/db.ts:1079
MEDIUM sql-template-interpolation lib/db.ts:1107
MEDIUM redos-nested-quantifier lib/markdown.ts:109
MEDIUM sh-remote-script-execution public/install.sh:124
MEDIUM sh-remote-script-execution public/install.sh:128
MEDIUM sh-remote-script-execution public/install.sh:147
LOW secret-generic-credential tests/domain-webhook-active.test.mjs:18
LOW secret-generic-credential tests/domain-webhook-active.test.mjs:25
LOW secret-generic-credential tests/domain-webhook-active.test.mjs:30
LOW secret-generic-credential tests/project-webhook-management.test.mjs:53

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit d41d62d into master Sep 13, 2026
5 checks passed
@ralyodio
ralyodio deleted the fix/installer-runtime-deps branch September 13, 2026 07:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant