feat(dns): resolve third-level names through an owner's wildcard - #301
Merged
Conversation
Syncs the vendored bridge with @moshcoder/moshpit-dns 0.5.0. The devDependency was pinned at ^0.3.0 while the package had reached 0.4.1, so the drift test — whose whole job is to make divergence loud — had been comparing against a version two releases behind and passing. The namespace is no longer one level deep. `www.chovy.hacker` is asked of the registry as written, and a name it does not hold falls back to the owner's published `*.chovy.hacker`. A sub-name that misses both is NXDOMAIN rather than parked: parking says a name is for sale, and a name under someone else's name is not, so parking it would advertise their subdomains to a stranger. Two things the port had to get right beyond copying: The timeout is per ask rather than per call. The wildcard fallback is a second request, and the vendored copy's single AbortController would have handed it whatever was left of the first one's budget — sometimes nothing. `dns resolve` prints from a map keyed by status, and nothing had taught it the new `nxdomain` one, so `explain[result.status]()` threw a TypeError over the top of the answer. The full suite stayed green through it because every other resolve test asks for --json, which never touches the human branch. Fixed, and covered by a test that walks every status the resolver can return. Forwarding is unaffected: `isOurs` still gates on the ending, so `www.google.com` is still someone else's to answer. Four labels remain a shape the registry cannot hold. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Syncs the vendored
src/dns.mjswith@moshcoder/moshpit-dns0.5.0 (published from moshcoder/moshpit-dns#18 for this).www.chovy.hackernow resolves — asked of the registry as written, falling back to the owner's published*.chovy.hacker*is a label only whole and only leftmost^0.3.0→^0.5.0Why the drift test never caught this
It was pinned at
^0.3.0while the package had reached 0.4.1, so the guard was comparing against a version two releases behind — and passing. Bumping it is what made the gap visible.Two things the port had to get right beyond copying
Per-ask timeout. The wildcard fallback is a second request. The vendored copy used one
AbortControllerfor the whole call, which would have handed the retry whatever was left of the first one's budget — sometimes nothing.dns resolvecrashed on the new status. It prints from a map keyed by status and nothing taught itnxdomain, soexplain[result.status]()threw a TypeError over the top of the answer. The suite stayed green through it because every other resolve test passes--json, which never touches the human branch. Fixed, plus a test that walks every status the resolver can return.Forwarding is unaffected
isOursstill gates on the ending, verified directly:www.google.commail.example.co.ukwww.chovy.hackera.b.chovy.hackerVerification
parseRegistryNameandresolveNameagainst the published package, comparing return values and the registry ask sequences: 0 divergencestest/dns-subdomains.test.mjs(9 tests) covers the wildcard fallback, the no-double-ask rule, parking still working for bare names, and the subdomain × proxy-mode interaction that exists only in moshcode🤖 Generated with Claude Code