moshcode 0.84.0 → 0.86.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "type": "module",
   "description": "moshcode \u2014 a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {

package/src/dns-service.mjs

@@ -33,6 +33,7 @@ import { mkdir, rm, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { operatorHome } from "./trust.mjs";
 
 export const UNIT_NAME = "moshcode-dns.service";
 
@@ -217,7 +218,7 @@ export function proxyServicePaths() {
 export function proxyServiceUnit({
   wrapper,
   nodeDir,
-  home = homedir(),
+  home = operatorHome(),
   user = process.env.SUDO_USER || process.env.USER || process.env.LOGNAME,
   port = 443,
   tlds = [],
@@ -249,10 +250,14 @@ export function proxyServiceUnit({
     `Environment=MOSHPIT_PROXY_PORT=${port}`,
     `Environment=MOSHPIT_PROXY_DIR=${dir}`,
   ];
-  // Only the endings it is asked to serve. Left unset it defaults to `.moshpit`
-  // alone, which is why a proxy can be running, healthy, and unable to present
-  // a certificate for the name someone is actually trying to reach.
-  if (tlds.length) lines.push(`Environment=MOSHPIT_PROXY_TLDS=${tlds.join(",")}`);
+  // Deliberately not written any more.
+  //
+  // It used to be set from the endings the registry had sold — 18224 of them, a
+  // ~150 KB environment variable in a unit file, for a list stale the next time
+  // one is sold. moshpit-proxy now reads an unset value as "every Moshpit
+  // ending", defining the namespace by excluding the real internet rather than
+  // by enumerating what Moshpit owns, so there is nothing left to pass. Setting
+  // it there still narrows, which is a deployment's choice and not this unit's.
 
   lines.push(
     `ExecStart=${wrapper}`,
@@ -273,7 +278,7 @@ export function proxyServiceUnit({
 }
 
 /** Where moshpit-proxy's installer puts its wrapper, if it ran. */
-export function proxyWrapperPath({ home = homedir(), exists = existsSync } = {}) {
+export function proxyWrapperPath({ home = operatorHome(), exists = existsSync } = {}) {
   const candidate = join(home, ".local/bin/moshpit-proxy");
   return exists(candidate) ? candidate : null;
 }
@@ -293,7 +298,7 @@ export function proxyWrapperPath({ home = homedir(), exists = existsSync } = {})
  * answer, so the wait is generous.
  */
 export async function ensureProxyService({
-  home = homedir(),
+  home = operatorHome(),
   user = process.env.SUDO_USER || process.env.USER || process.env.LOGNAME,
   nodeDir = dirname(process.execPath),
   tlds = [],

package/src/trust.mjs

@@ -20,6 +20,7 @@
 import path from "node:path";
 import os from "node:os";
 import { execFileSync } from "node:child_process";
+import { IANA_TLDS } from "./iana-tlds.mjs";
 
 /** Where moshpit-proxy generates its root on first run. */
 export function caPath({ home = os.homedir(), dir = null } = {}) {
@@ -139,20 +140,74 @@ export function requireNameConstraints(text, { tlds = [] } = {}) {
   // `excluded;DNS:.hacker` alone is an unconstrained root wearing the word
   // "constraints". Requiring a permitted DNS subtree is what makes the rest of
   // this check mean anything.
+  const bare = (entry) => entry.replace(/^\./, "");
+
+  // Two shapes are acceptable, and they make the same promise a different way.
+  //
+  // The old one permits a list of Moshpit endings and is bounded by what it
+  // names. It cannot scale: there are 18224 endings, a permitted subtree each
+  // is roughly 214 KB of constraints on every handshake, and the list is stale
+  // the next time the registry sells one — which is why a machine could reach
+  // `.2600` over HTTPS and not `.hacker`.
+  //
+  // The new one names nothing and excludes the real internet instead: all 1438
+  // delegated top-level domains, about 15 KB, covering every Moshpit ending
+  // that exists or ever will. RFC 5280 4.2.1.10 leaves a name type unrestricted
+  // when no permitted subtree names it, which is what makes that work — and is
+  // also exactly what an unconstrained root looks like, so the difference has
+  // to be established rather than assumed.
+  //
+  // It is established against the same IANA list this tool refuses to sell
+  // endings from. A root that excludes the internet cannot forge your bank,
+  // which is the whole property the old shape bought by enumeration.
   if (!constraints.permitted.length) {
-    return {
-      ok: false,
-      kind: "unconstrained",
-      why: "the root permits no DNS subtree, so every name it does not exclude is allowed — it could vouch for any name",
-    };
+    const excluded = new Set(constraints.excluded.map(bare));
+    const covered = [...IANA_TLDS].filter((tld) => excluded.has(tld));
+    const uncovered = [...IANA_TLDS].filter((tld) => !excluded.has(tld));
+
+    // A handful of exclusions is not this shape; it is an unconstrained root
+    // with a few names crossed out, which is the thing this gate exists to
+    // refuse. The threshold sits far below the real count on purpose: the
+    // question is "is the internet excluded", not "is this list current".
+    if (covered.length < 1000) {
+      return {
+        ok: false,
+        kind: "unconstrained",
+        why: covered.length
+          ? `the root excludes only ${covered.length} real top-level domains — it could still vouch for the rest of the internet`
+          : "the root permits no DNS subtree and excludes no real domains, so it could vouch for any name",
+      };
+    }
+
+    // A root minted before a TLD was delegated does not exclude it. A real gap,
+    // and a small one, so it is reported rather than made fatal: refusing here
+    // would mean refusing every root the day IANA adds a name.
+    return uncovered.length
+      ? { ok: true, why: `excludes ${covered.length} real top-level domains`, uncovered }
+      : { ok: true, why: `excludes all ${covered.length} real top-level domains` };
   }
 
-  const bare = (entry) => entry.replace(/^\./, "");
   const permits = (tld) => constraints.permitted.some((entry) => bare(entry) === String(tld).toLowerCase());
 
   const missing = tlds.filter((tld) => !permits(tld));
-  if (missing.length) {
-    return { ok: false, kind: "out-of-step", why: `the root does not permit ${missing.join(", ")}` };
+  // Not a refusal, and this was the single most damaging line in the file.
+  //
+  // The root is minted by moshpit-proxy for the endings it was configured to
+  // serve — a handful. `tlds` is every ending the registry has sold, which is
+  // 18224 and climbing. So this could never pass on a real machine: it refused
+  // to install a perfectly good root because it did not also cover 18000
+  // endings nobody on that machine was trying to reach, and printed all of them
+  // as evidence. The advice it gave — regenerate the root — cannot help,
+  // because the new root is scoped to the same handful.
+  //
+  // A root that covers some of what you resolve is worth exactly what it
+  // covers. So it goes in, and the shortfall is a count rather than a wall.
+  if (missing.length === tlds.length) {
+    return {
+      ok: false,
+      kind: "out-of-step",
+      why: `the root permits none of the endings claimed (${summarise(missing)}) — it is for a different namespace`,
+    };
   }
   // And nothing beyond them. One `DNS:.com` in the permitted subtree is the
   // whole hole this gate exists to close, and it would otherwise sail through
@@ -163,10 +218,32 @@ export function requireNameConstraints(text, { tlds = [] } = {}) {
     return {
       ok: false,
       kind: "out-of-step",
-      why: `the root also permits ${foreign.join(", ")}, which is not an ending we resolve — it reaches past Moshpit`,
+      why: `the root also permits ${summarise(foreign)}, which is not an ending we resolve — it reaches past Moshpit`,
     };
   }
-  return { ok: true, why: "constrained to Moshpit endings" };
+  // Carried, not printed here: the caller decides how loud a partial root is,
+  // and it is the only place that knows whether the person asked about a name
+  // the root actually covers.
+  return missing.length
+    ? {
+      ok: true,
+      why: `constrained to Moshpit endings — covers ${tlds.length - missing.length} of ${tlds.length}`,
+      missing,
+    }
+    : { ok: true, why: "constrained to Moshpit endings" };
+}
+
+/**
+ * A list a person can read, rather than one that fills the terminal.
+ *
+ * A registry with 18224 endings turns any "these are wrong" message into
+ * several screens of text, which is not a diagnostic — it is the reason nobody
+ * reads the line above it.
+ */
+export function summarise(items, show = 8) {
+  const list = [...items];
+  if (list.length <= show) return list.join(", ");
+  return `${list.slice(0, show).join(", ")} and ${list.length - show} more`;
 }
 
 /**