chore(release): v0.14.0

[ralyodio]

install.sh resolves releases/latest, so the seventeen commits merged since v0.13.3 have been sitting on main unreachable — including a fix for a page that locks browsers up.

Headline: the pit

/pit rendered every ending an account held, and a <form> per name under each, with no bound on either end. At 50 endings × 100 names that was 3.1 MiB of HTML and 36,082 DOM elements — and it jammed browsers with no script on the page at all (#167).

It now draws a window and states what it isn't drawing: 173 KiB, 1,926 elements. With a filter box over the top — eggs as a substring, def* as a glob, debounced against the API, and readable server-side from ?q= so it works with the script blocked (#168).

The namespace also stopped being the one part of the product a script couldn't touch: /api/moshpit/* now accepts the same API key /api/me and /api/sessions already did (#169). And /pit/dns finally documents the TronBrowser route, for machines whose DNS isn't theirs to change (#165).

Pricing stopped lying: $2 a name is a default, not a ceiling. The server always allowed more — the claim form shipped max="2" and made it look like policy (#170).

Also in

• db: foreign keys are enforced, and the licence package.json claims actually ships (db: enforce foreign keys, and ship the licence package.json claims #154)
• cli: help aliases exit 0 (fix(cli): return success for help aliases #157) · invalid integration commands fail (fix(cli): fail invalid integration commands #160) · -- is honoured (fix(run): honor the end-of-options separator #159) · a BOM before a shebang no longer breaks (fix(runtime): handle BOM before shebang #158)
• skills: engines with no skills primitive are reported rather than dropped (fix(skills): report the engines with no skills primitive instead of dropping them #166) · --name requires a value (fix(skill): require a name flag value #156)
• mcp: an unsupported flag is rejected instead of registered as the server name (fix(mcp): reject an unsupported flag instead of registering it as the server name #164)
• pit: namespace rules vendored again, with a drift test holding them to the published package (pit: depend on @moshcoder/moshpit-name instead of keeping a copy #161, test: catch the vendored DNS bridge drifting from the published one #162, fix(pit): vendor the namespace rules again — main is red #163)
• prd: a backslash in a title no longer eats the index row's columns (fix(prd): escape a backslash in a PRD title so the index row keeps its columns #155)

Testing

bin/moshcode.mjs --version → 0.14.0. Repo root: 523 pass, 0 fail, 144 skipped (pwa deps absent, as designed). apps/pwa with deps installed: 330 pass, 0 fail.

After merge

No release workflow exists in .github/workflows, so the tag and GitHub release are still manual — releases/latest is what install.sh reads, so the bump alone doesn't reach anyone.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.