test: catch the vendored DNS bridge drifting from the published one - #162
Merged
Conversation
src/dns.mjs is a copy of @moshcoder/moshpit-dns, and it stays a copy on purpose: moshcode ships as a tarball that nothing runs `npm install` over, so a runtime dependency would break every install. The cost of that choice is drift, and this makes drift loud instead of silent. Behaviour, not bytes. The two differ cosmetically — the standalone tool names itself in the config comments it writes — so a byte comparison would fail on that forever while missing a real divergence in what the protocol does. This runs both over the same inputs and requires the same answers: encoded names, decoded names including the rejections, parsed queries, and responses compared byte-for-byte on the wire, which is the one that matters most. A resolver that disagrees about bytes answers differently depending on which copy ran. A dev dependency, so the shipped tarball is unaffected and only CI pays for it. Skips cleanly when the package is not installed. Verified it can fail: changing DEFAULT_TTL in the vendored copy alone turns the suite red. A drift test that cannot catch drift is worse than none, because it reads like assurance. 485 pass, 120 skipped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
ralyodio
added a commit
that referenced
this pull request
Jul 31, 2026
#161 replaced apps/pwa/src/lib/moshpit-name.mjs with a re-export of @moshcoder/moshpit-name. That broke main: three test files now fail at import with ERR_MODULE_NOT_FOUND. I had it wrong. apps/pwa is not part of a pnpm workspace and has no workspaces field, so the repo-root `pnpm install --frozen-lockfile` that CI runs never reaches it — its dependencies are simply absent there, which is why 116 of its tests have always skipped. The claim in #161 that this was "the one consumer that does npm install" was not true; nothing installs them in CI. Worse, the failure mode changed. Those tests used to skip when a dependency was missing. A re-export at the top of a module every one of them imports fails at load instead, so the pure tests — which need nothing — went down with the ones that need a database. So the vendored copy comes back, and gets the same treatment as src/dns.mjs in #162: a dev-only dependency and a drift test that compares behaviour rather than bytes. Parsing across the whole hostname space, the reserved list, prices and limits, pasted lists with their per-line settings, and resolution precedence. Verified both ways this time. It skips cleanly with no dev dependencies, which is what CI has. It fails when ENDING_PRICE_USD is changed in the copy alone. And the full suite with apps/pwa/node_modules removed — CI, exactly — is 484 pass, 0 fail, 122 skipped. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merged
ralyodio
added a commit
that referenced
this pull request
Aug 1, 2026
install.sh resolves releases/latest, so the sixteen commits merged since v0.13.3 have been sitting on main unreachable — including a fix for a page that locks browsers up. The headline is the pit. /pit rendered every ending an account held and a form per name under each, with no bound on either: at 50 endings x 100 names that was 3.1 MiB of HTML and 36,082 DOM elements, and it managed to jam a browser with no script on the page at all (#167). It now draws a window and says what it is not drawing — 173 KiB, 1,926 elements — with a filter box over the top that takes `eggs` as a substring and `def*` as a glob, debounced against the API (#168). The namespace also stopped being the one part of the product a script could not touch: /api/moshpit/* now accepts the same API key /api/me and /api/sessions already did (#169), and /pit/dns finally documents the TronBrowser route for machines whose DNS is not theirs to change (#165). moshcode: foreign keys are enforced, and the licence package.json claims actually ships (#154) cli: help aliases exit 0 (#157), invalid integration commands fail (#160), `--` is honoured (#159), a BOM before a shebang no longer breaks (#158) skills: engines with no skills primitive are reported, not dropped (#166); `--name` requires a value (#156) mcp: an unsupported flag is rejected rather than registered as the server name (#164) pit: the namespace rules are vendored again with a drift test holding them to the published package (#161, #162, #163) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
src/dns.mjsis a copy of @moshcoder/moshpit-dns, and it stays a copy on purpose.moshcode ships as a tarball that nothing runs
npm installover —install.shextracts and that's it. A runtime dependency would break every install. The cost of that choice is drift, and this makes drift loud instead of silent.Behaviour, not bytes
The two differ cosmetically — the standalone tool names itself in the config comments it writes. A byte comparison would fail on that forever while missing a real divergence in what the protocol does.
So this runs both over the same inputs and requires the same answers:
A dev dependency
The shipped tarball is unaffected; only CI pays for it. Skips cleanly when the package isn't installed, so a checkout without dev deps still runs the rest.
Verified it can actually fail
Changing
DEFAULT_TTLin the vendored copy alone turns the suite red:A drift test that can't catch drift is worse than none, because it reads like assurance.
485 pass, 120 skipped.
Also fixed on the way
All four
@moshcoder/moshpit-*packages had anexportsmap that silently made<pkg>/package.jsonunresolvable — an exports map is a closed list. Found because this test couldn't ask which version it was comparing against. Patched and republished (moshpit-dns@0.2.1, the others0.1.1).🤖 Generated with Claude Code