moshcode 0.85.0 → 0.87.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "type": "module",
   "description": "moshcode \u2014 a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {

package/src/dns-service.mjs

@@ -130,10 +130,12 @@ export function serviceUnit({
 function run(command, args) {
   return new Promise((resolve) => {
     const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let out = "";
     let err = "";
+    child.stdout.on("data", (d) => (out += d));
     child.stderr.on("data", (d) => (err += d));
     child.on("error", (error) => resolve({ ok: false, error: error.message }));
-    child.on("exit", (code) => resolve({ ok: code === 0, error: err.trim() }));
+    child.on("exit", (code) => resolve({ ok: code === 0, stdout: out, error: err.trim() }));
   });
 }
 
@@ -250,10 +252,14 @@ export function proxyServiceUnit({
     `Environment=MOSHPIT_PROXY_PORT=${port}`,
     `Environment=MOSHPIT_PROXY_DIR=${dir}`,
   ];
-  // Only the endings it is asked to serve. Left unset it defaults to `.moshpit`
-  // alone, which is why a proxy can be running, healthy, and unable to present
-  // a certificate for the name someone is actually trying to reach.
-  if (tlds.length) lines.push(`Environment=MOSHPIT_PROXY_TLDS=${tlds.join(",")}`);
+  // Deliberately not written any more.
+  //
+  // It used to be set from the endings the registry had sold — 18224 of them, a
+  // ~150 KB environment variable in a unit file, for a list stale the next time
+  // one is sold. moshpit-proxy now reads an unset value as "every Moshpit
+  // ending", defining the namespace by excluding the real internet rather than
+  // by enumerating what Moshpit owns, so there is nothing left to pass. Setting
+  // it there still narrows, which is a deployment's choice and not this unit's.
 
   lines.push(
     `ExecStart=${wrapper}`,
@@ -273,6 +279,38 @@ export function proxyServiceUnit({
   return lines.join("\n");
 }
 
+/**
+ * Is the local root the old shape, minted for a list of endings?
+ *
+ * moshpit-proxy used to constrain its root by naming what it could certify.
+ * That root works only for the endings it happened to name, which is why a
+ * machine could reach `.2600` over HTTPS and not `.hacker` — and why the list
+ * could never be right, since the registry keeps selling more.
+ *
+ * The root it mints now excludes the real internet instead and covers the whole
+ * namespace. But a machine that ran the old proxy still has the old root on
+ * disk, and moshpit-proxy will not replace a root that already exists — so
+ * without this, upgrading leaves the narrow root in place and `.hacker` keeps
+ * failing with nothing to explain why.
+ *
+ * A permitted DNS subtree is the tell. The new root has none by design.
+ */
+export async function rootIsNarrow({
+  home = operatorHome(),
+  exec = run,
+  exists = existsSync,
+} = {}) {
+  const file = join(home, ".moshpit", "ca", "ca.crt");
+  if (!exists(file)) return { narrow: false, reason: "no root yet", file };
+  const described = await exec("openssl", ["x509", "-noout", "-text", "-in", file]);
+  // Unreadable is not narrow. Deleting a root because openssl was missing would
+  // throw away a working setup to fix a problem nobody had.
+  if (!described.ok) return { narrow: false, reason: "could not read it", file };
+  return described.stdout && /Permitted:/i.test(described.stdout)
+    ? { narrow: true, reason: "constrained to a list of endings", file }
+    : { narrow: false, reason: "already covers the namespace", file };
+}
+
 /** Where moshpit-proxy's installer puts its wrapper, if it ran. */
 export function proxyWrapperPath({ home = operatorHome(), exists = existsSync } = {}) {
   const candidate = join(home, ".local/bin/moshpit-proxy");
@@ -300,6 +338,8 @@ export async function ensureProxyService({
   tlds = [],
   port = 443,
   exec = run,
+  narrowRoot = rootIsNarrow,
+  paths = proxyServicePaths,
   read = async (f) => (await import("node:fs/promises")).readFile(f, "utf8"),
   listening = defaultPortHeld,
   waitMs = 30000,
@@ -307,7 +347,7 @@ export async function ensureProxyService({
   const wrapper = proxyWrapperPath({ home });
   if (!wrapper) return { ok: false, reason: "not-installed", steps: [] };
 
-  const { path, systemctl } = proxyServicePaths();
+  const { path, systemctl } = paths();
   const unit = proxyServiceUnit({ wrapper, nodeDir, home, user, port, tlds });
   // Read before writing so the manifest can put back whatever was here — which
   // is usually nothing, and "nothing" has to be recorded as precisely as
@@ -315,6 +355,22 @@ export async function ensureProxyService({
   const before = await read(path).catch(() => null);
 
   const steps = [];
+
+  // A root minted by the old proxy names the endings it may certify, and
+  // moshpit-proxy will not replace a root that already exists. Left alone, an
+  // upgraded machine keeps the narrow root and `.hacker` keeps failing — so it
+  // goes, and the proxy mints the current shape on its next start.
+  //
+  // Safe to remove: it is a local root, regenerated in seconds, and `dns enable`
+  // installs the replacement into the trust stores in the same run. Removing it
+  // without that would be the destructive half on its own, which is why this
+  // lives here and not in the installer.
+  const narrow = await narrowRoot({ home, exec });
+  if (narrow.narrow) {
+    await rm(join(home, ".moshpit", "ca"), { recursive: true, force: true }).catch(() => {});
+    steps.push({ step: `reminted the local root — the old one was ${narrow.reason}`, ok: true });
+  }
+
   try {
     await mkdir(dirname(path), { recursive: true });
     await writeFile(path, unit);
@@ -324,7 +380,14 @@ export async function ensureProxyService({
   }
 
   const [cmd, ...flags] = systemctl;
-  for (const args of [[...flags, "daemon-reload"], [...flags, "enable", "--now", PROXY_UNIT_NAME]]) {
+  // `enable --now` starts a stopped unit and does nothing to a running one, so
+  // an upgrade would leave the previous process — and the previous root, and
+  // the previous namespace — in place. Restart is what makes an upgrade take.
+  for (const args of [
+    [...flags, "daemon-reload"],
+    [...flags, "enable", PROXY_UNIT_NAME],
+    [...flags, "restart", PROXY_UNIT_NAME],
+  ]) {
     const result = await exec(cmd, args);
     steps.push({ step: `${cmd} ${args.join(" ")}`, ok: result.ok, error: result.error });
     if (!result.ok) return { ok: false, reason: "systemctl-failed", before, steps, path, unit };

package/src/trust.mjs

@@ -20,6 +20,7 @@
 import path from "node:path";
 import os from "node:os";
 import { execFileSync } from "node:child_process";
+import { IANA_TLDS } from "./iana-tlds.mjs";
 
 /** Where moshpit-proxy generates its root on first run. */
 export function caPath({ home = os.homedir(), dir = null } = {}) {
@@ -139,15 +140,53 @@ export function requireNameConstraints(text, { tlds = [] } = {}) {
   // `excluded;DNS:.hacker` alone is an unconstrained root wearing the word
   // "constraints". Requiring a permitted DNS subtree is what makes the rest of
   // this check mean anything.
+  const bare = (entry) => entry.replace(/^\./, "");
+
+  // Two shapes are acceptable, and they make the same promise a different way.
+  //
+  // The old one permits a list of Moshpit endings and is bounded by what it
+  // names. It cannot scale: there are 18224 endings, a permitted subtree each
+  // is roughly 214 KB of constraints on every handshake, and the list is stale
+  // the next time the registry sells one — which is why a machine could reach
+  // `.2600` over HTTPS and not `.hacker`.
+  //
+  // The new one names nothing and excludes the real internet instead: all 1438
+  // delegated top-level domains, about 15 KB, covering every Moshpit ending
+  // that exists or ever will. RFC 5280 4.2.1.10 leaves a name type unrestricted
+  // when no permitted subtree names it, which is what makes that work — and is
+  // also exactly what an unconstrained root looks like, so the difference has
+  // to be established rather than assumed.
+  //
+  // It is established against the same IANA list this tool refuses to sell
+  // endings from. A root that excludes the internet cannot forge your bank,
+  // which is the whole property the old shape bought by enumeration.
   if (!constraints.permitted.length) {
-    return {
-      ok: false,
-      kind: "unconstrained",
-      why: "the root permits no DNS subtree, so every name it does not exclude is allowed — it could vouch for any name",
-    };
+    const excluded = new Set(constraints.excluded.map(bare));
+    const covered = [...IANA_TLDS].filter((tld) => excluded.has(tld));
+    const uncovered = [...IANA_TLDS].filter((tld) => !excluded.has(tld));
+
+    // A handful of exclusions is not this shape; it is an unconstrained root
+    // with a few names crossed out, which is the thing this gate exists to
+    // refuse. The threshold sits far below the real count on purpose: the
+    // question is "is the internet excluded", not "is this list current".
+    if (covered.length < 1000) {
+      return {
+        ok: false,
+        kind: "unconstrained",
+        why: covered.length
+          ? `the root excludes only ${covered.length} real top-level domains — it could still vouch for the rest of the internet`
+          : "the root permits no DNS subtree and excludes no real domains, so it could vouch for any name",
+      };
+    }
+
+    // A root minted before a TLD was delegated does not exclude it. A real gap,
+    // and a small one, so it is reported rather than made fatal: refusing here
+    // would mean refusing every root the day IANA adds a name.
+    return uncovered.length
+      ? { ok: true, why: `excludes ${covered.length} real top-level domains`, uncovered }
+      : { ok: true, why: `excludes all ${covered.length} real top-level domains` };
   }
 
-  const bare = (entry) => entry.replace(/^\./, "");
   const permits = (tld) => constraints.permitted.some((entry) => bare(entry) === String(tld).toLowerCase());
 
   const missing = tlds.filter((tld) => !permits(tld));