moshcode 0.87.0 → 0.89.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.87.0",
+  "version": "0.89.0",
   "type": "module",
   "description": "moshcode \u2014 a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {

package/src/dns.mjs

@@ -1695,6 +1695,36 @@ export function proxyProbeFromArgs(args = [], claimed = []) {
   return { name: claimed[0] ? `a.${claimed[0]}` : null, invalid: false };
 }
 
+/**
+ * A Moshpit name to test this machine's setup with.
+ *
+ * Synthetic on purpose — the proxy mints a certificate for any name inside the
+ * namespace, so the probe does not have to name something anybody registered.
+ * What it does have to be is a hostname the rest of the program can parse.
+ *
+ * `a.${tlds[0]}` was not. The first ending the registry returns is `00`, and
+ * `https://a.00/` is rejected outright by the WHATWG URL parser: a final label
+ * of digits makes the whole host a candidate IPv4 literal, and `a.00` is not a
+ * valid one. So proxy detection asked about a name that could not be looked up,
+ * concluded there was no proxy on a machine that had one running and holding
+ * 443, and started the bridge without proxy mode — leaving every name to answer
+ * its origin with a certificate no CA has signed.
+ *
+ * An all-numeric ending is legal and wanted (`.420`, `.2600`); it is unusable
+ * only here, which is why this skips them for the probe rather than the registry
+ * refusing to sell them. `--proxy-probe <name>` overrides, for a machine where
+ * the choice has to be a specific real name.
+ */
+export function probeName(tlds = [], args = []) {
+  const at = args.indexOf("--proxy-probe");
+  if (at >= 0) {
+    const given = args[at + 1];
+    if (given && !given.startsWith("--")) return given;
+  }
+  const usable = tlds.find((t) => !/^\d+$/.test(String(t)));
+  return usable ? `a.${usable}` : null;
+}
+
 export function upstreamsFromArgs(args = []) {
   const servers = [];
   const invalid = [];
@@ -3095,7 +3125,7 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
 
     // The name whose resolution proves the bridge is answering, alongside the
     // clearnet one that proves it is forwarding.
-    const moshpitProbe = tlds[0] ? `a.${tlds[0]}` : null;
+    const moshpitProbe = probeName(tlds, rest);
     // Restoring files is not a rollback on Windows: NRPT rules are not files,
     // so the undo is the disable plan's commands rather than the enable plan's.
     const undoSteps = platform === "windows" ? disablePlan({ platform, tlds, linuxBackend }).steps : undefined;
@@ -3264,6 +3294,7 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     // Moshpit names and cannot verify them, which is bad; a machine whose DNS
     // was refused because an optional component would not start is worse.
     let proxyUnitPath = null;
+    let ours = false;
     if (!rest.includes("--no-proxy") && platform === "linux") {
       if (!proxyWrapper()) {
         out("  --   no pinned-TLS proxy installed — https:// on a name will not verify");
@@ -3276,6 +3307,10 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
           out(`  ${step.ok ? "ok  " : "--  "} ${step.step}${step.error ? ` — ${step.error}` : ""}`);
         }
         if (!ensured.ok) out(`  --   the proxy is not serving (${ensured.reason}) — https:// will not verify`);
+        // Started by this run, and confirmed holding the port. That is the
+        // strongest evidence available that the proxy on 443 is ours, and it is
+        // strictly better than the handshake below.
+        ours = ensured.ok;
       }
     }
 
@@ -3333,6 +3368,26 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
       // proxy and retracting it two lines later is worse than not looking.
       out("  --   the bridge already running was not started by this run, so it keeps its own");
       out("       mode — to pick up proxy mode: moshcode dns disable && moshcode dns enable");
+    } else if (ours) {
+      // No handshake needed, and none that would work.
+      //
+      // The probe asks the proxy for a certificate under some name. The proxy
+      // will not present one for a name with no key published in the registry —
+      // deliberately, so a browser gets a TLS failure it can explain rather than
+      // a reset mid-request — and this command has no way to invent a name that
+      // someone has registered. There is no endpoint that lists names, only
+      // endings, so `a.<ending>` is the best it could ever do and that is
+      // exactly the name the proxy refuses.
+      //
+      // Which made the check impossible to pass on a correctly configured
+      // machine: `proxy holds 127.0.0.1:443` and `no pinned-TLS proxy on this
+      // machine`, three lines apart, both true as written.
+      //
+      // So when this run installed the unit, started it, and watched it take the
+      // port, that is the answer. The probe below stays for a proxy this run did
+      // not start, where the question is genuinely open.
+      proxyAddress = { v4: DEFAULT_HOST, v6: null };
+      out(`  ok   pinned-TLS proxy on ${DEFAULT_HOST}:${PROXY_PORT} — started by this run, so every live name will answer there`);
     } else if (!rest.includes("--no-proxy")) {
       const probeName = moshpitProbe || "";
       if (!probeName) {