Skip to content

Add noodle to the tool registry - #495

Merged
ralyodio merged 1 commit into
mainfrom
worktree-noodle-tool
Sep 7, 2026
Merged

Add noodle to the tool registry#495
ralyodio merged 1 commit into
mainfrom
worktree-noodle-tool

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Adds Noodle — a terminal REST client — to moshcode install / moshcode tools / top-level passthrough.

curl -LsSf https://noodlerest.dev/install.sh | sh

Why it sits where it does

Next to mcpjam in the registry: mcpjam tells you whether an MCP server answers, noodle is how you ask an HTTP one anything at all. Every request is a readable YAML file kept beside the code it exercises, so a collection is reviewed in a diff and runnable from a pipeline.

The three judgement calls

  • bash, not sh. The installer declares a bash shebang and uses local — the opposite of the c0upons entry beside it, which avoids bashisms on purpose.
  • No upgrade key. Noodle ships no updater. The installer always fetches the latest release, checks it against the published SHA256SUMS, and renames it over the existing binary atomically, so re-running the install is the upgrade and toolUpgradeSpec falls back to it.
  • binDirs. It lands in ~/.local/bin and appends nothing to PATH — the same gap turso, gradient, kimi and yt-dlp have.

Verified live, not just specified

Per the house rule that an install exiting 0 is not an install, this was exercised end to end against the real installer on noodle 0.8.5:

  • moshcode install noodle → downloaded, checksum-verified, ~/.local/bin/noodle
  • moshcode tools● noodle
  • moshcode noodle --version0.8.5 through passthrough
  • moshcode upgrade noodle → re-ran the installer, ✓ noodle up to date, exit 0

Full suite green: 2896 tests, 0 fail (2563 pass, 333 pre-existing skips), including two new tests — the install-delegation table row and a dedicated entry test covering bin, install spec, upgrade fallback, no-escalation and binDirs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PqnstZRhi764pihZounU3n

Noodle is a terminal REST client: every request is a readable YAML file
that lives beside the code it exercises, driven from the TUI, the CLI or
a script. It sits next to mcpjam in the registry for the obvious reason —
mcpjam tells you whether an MCP server answers, noodle is how you ask an
HTTP one anything at all.

It ships a per-platform static binary on its own GitHub releases rather
than npm, so the install is the vendor script. Through `bash`, not `sh`:
the script declares a bash shebang and uses `local`, unlike the c0upons
installer beside it, which avoids bashisms on purpose.

No `upgrade` key. Noodle ships no updater of its own, and the installer
always fetches the latest release, checks it against the published
SHA256SUMS and renames it over the existing binary atomically, so
re-running the install IS the upgrade and toolUpgradeSpec falls back to
it. The binary lands in ~/.local/bin and nothing appends to PATH, hence
binDirs — the same gap turso, gradient, kimi and yt-dlp have.

Verified against the live installer rather than the spec alone: install,
`moshcode tools` status, top-level passthrough and the upgrade re-run all
exercised end to end on noodle 0.8.5.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqnstZRhi764pihZounU3n
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 4 file(s) this pull request changes.

Nothing in the files this pull request changes.

92 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 74 | **LOW**: 10

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:202
HIGH sh-remote-script-execution install.sh:213
HIGH sh-remote-script-execution install.sh:219
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:671
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:867
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:869
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:928
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:974
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:1044

…and 72 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 489af5a into main Sep 7, 2026
6 of 7 checks passed
@ralyodio
ralyodio deleted the worktree-noodle-tool branch September 7, 2026 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant