Skip to content

feat(tools): /install crawlproof installs CrawlProof - #491

Merged
ralyodio merged 1 commit into
mainfrom
crawlproof-tool
Sep 6, 2026
Merged

feat(tools): /install crawlproof installs CrawlProof#491
ralyodio merged 1 commit into
mainfrom
crawlproof-tool

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 6, 2026

Copy link
Copy Markdown
Contributor
mosh ▸ /install crawlproof
✗ unknown engine or tool "crawlproof"

CrawlProof reached a box only as part of the cli-tools set, so installing it meant knowing that it travels with seven other commands. The pit should not expect anyone to know that.

Now it has its own entry:

moshcode install crawlproof       # npm i -g @profullstack/crawlproof
moshcode crawlproof               # the live dashboard
moshcode crawlproof stats site.com

Two install paths, deliberately

The cli-tools set symlinks a wrapper named crawlproof, and this entry installs the package that wrapper vendors. Having both on a box is safe rather than merely tolerated: the wrapper hands over to a crawlproof on PATH that is not its own, and refuses to follow one that is, which would be an exec loop. That refusal is tested upstream in cli-tools.

Shape

An ordinary global npm package with no upgrade key, because npm install -g is idempotent and the install is also the upgrade, the same as bo and railway. Modeled on the bo entry throughout.

The dashboard is a TUI and wants Node 22.6+; stats and --json run anywhere. Noted in the comment and the README rather than enforced, since nothing else in TOOLS declares a Node floor.

Verified

toolList() now prints the row, and /install crawlproof resolves instead of erroring. Tests: 106 passing across tools, help and tui — the structural test that walks every TOOLS entry covers the new one.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HvWJ4336pxTFRdRbvsTQeD

`/install crawlproof` printed "unknown engine or tool". The command existed on
a box only as part of the `cli-tools` set, so getting it meant knowing that it
travels with seven other commands, which is not something the pit should expect
anyone to know.

It is its own entry because `/install crawlproof` should install CrawlProof.
Reachable two ways on purpose: the `cli-tools` set symlinks a wrapper of the
same name, and this installs the package that wrapper vendors. Having both is
safe, because the wrapper hands over to a `crawlproof` on PATH that is not its
own and refuses to follow one that is, which would be an exec loop.

An ordinary global npm package, so `npm install -g` is idempotent and the
install is also the upgrade, the same as bo and railway. No upgrade key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvWJ4336pxTFRdRbvsTQeD
@github-actions

github-actions Bot commented Sep 6, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 2 file(s) this pull request changes.

Nothing in the files this pull request changes.

91 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 73 | **LOW**: 10

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:202
HIGH sh-remote-script-execution install.sh:213
HIGH sh-remote-script-execution install.sh:219
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:974
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1044

…and 71 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit d16d7fd into main Sep 6, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant