chore(release): v0.16.0

[ralyodio]

install.sh resolves releases/latest, so the twelve commits merged since v0.15.0 are unreachable to anyone running moshcode update — including the reason curl <name> still fails after dns enable.

Observed today on a live box: sudo moshcode update installed v0.15.0, sudo moshcode dns enable reported success, and curl -I http://chovy.hacker still said Could not resolve host.

⚠️ Merge order

This must not merge before #198. main is currently red — #198 is the lockfile bump that clears it, and its CI is green. Ideally #197 (the dns status truncation check) lands too, since it's the diagnostic for the exact failure this release fixes.

1. chore(deps): @moshcoder/moshpit-dns 0.2.1 -> 0.2.2 — unblocks main #198 → main green
2. feat(dns): status reports what the resolver accepted, not what we wrote #197 → the missing diagnostic
3. this → then cut the GitHub Release

The headline: routing stopped being a list

dns install wrote every claimed ending onto one Domains= line. systemd-resolved caps how many search domains it accepts:

written	4,586
accepted	1,090
rejected	3,496, one journal line each

systemd-resolved: Failed to add search domain '~zombies', ignoring: Argument list too long

Taken alphabetically, so ~hacker fell past the cut. Names in that range were configured on disk and absent from the resolver — moshcode dns resolve answered, curl did not, and nothing in between said why. Every new ending made the cut deeper.

Domains=~. is one entry that never grows. The bridge now forwards anything that isn't a claimed ending upstream, byte for byte, and fails open in every direction:

• an unknown ending set means "not ours" — failing that way costs a Moshpit name, failing the other way costs the whole internet on that machine
• silent upstreams are SERVFAIL, not NXDOMAIN — "couldn't find out" is retried, "doesn't exist" gets cached
• loopback nameservers are dropped, so it can't forward to itself

Also in this release

• IPv6 end to end — the bridge answers AAAA, and an A query for a v6-only name is NODATA rather than NXDOMAIN, which had been denying the name for the whole page load. The /n/ gateway brackets v6 hosts, which it previously built as invalid URLs.
• moshcode template — scaffolds a Moshpit-hosted service; bun-caddy-sqlite and caddy-static bundled. Nothing in a template executes on install.
• Letters and digits only — a dash was the cheapest way to mint a look-alike of an ending someone else holds, in a namespace one level deep with nothing to appeal into.
• An ending has its own page at /n/<ending>, showing its pointers and relatives instead of a dead end.

After merge

No tag-triggered workflow here, so the GitHub Release is the last manual step:

gh release create v0.16.0 --repo moshcoder/moshcode --title "v0.16.0 — routing stopped being a list" --generate-notes

Until that exists, install.sh keeps serving v0.15.0.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.