fix(moshpit): letters and digits only — no dashes, matching the registry

[ralyodio]

Draft: blocked on moshcoder/moshpit-resolve#3 publishing. See "CI will be red" below — that's the guard working, not a bug.

The change

Both local copies of the name grammar accepted a dash inside a label. The registry is dropping it (moshcoder/moshpit-name#6, moshcoder/moshcode#193), and a name accepted here but rejected there forwards the tab to a page saying it does not exist — worse than refusing it up front.

- const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+ const LABEL = /^[a-z0-9]{1,63}$/;

Changed in apps/desktop/src/moshpit-resolve.ts and extensions/ai-sidebar/moshpit.js together, since the extension is a hand port of the module.

Neither drift test would have caught this

This repo already has two, and both were blind to the exact rule in question:

test	compares	dashed cases it listed
moshpit.test.js	extension port ↔ TS reference	none
moshpit-drift.test.js	both ↔ @moshcoder/moshpit-resolve	none

Leading and trailing dashes were covered elsewhere from the start. A dash inside a label — the case this rule turns on — was covered nowhere. All three implementations could disagree and every assertion would still pass.

Both shared hostname lists now carry lazy-loaded, blue.lazy-loaded, register-me.eggs, a-b.c-d.

CI will be red until the package publishes

With the lists fixed, the anchor now fails against @moshcoder/moshpit-resolve@0.1.1 — and not merely on parsing. It's a behavioural difference:

blue.lazy-loaded → package 0.1.1: { use: 'park' }
                 → this branch:   { use: 'clearnet' }

A tab sent somewhere different. That's precisely what the anchor exists to catch.

To land: merge moshcoder/moshpit-resolve#3 → publish → bump @moshcoder/moshpit-resolve in apps/desktop/package.json → CI green → mark ready.

Six copies of one regex

For the record, this rule currently lives in: moshpit-name, moshpit-resolve, moshcode/apps/pwa, moshcode/src/dns.mjs, and both copies here. The packages can't be imported at runtime by the unbundled extension or by moshcode's tarball install, so the copies are deliberate — the drift tests are what make them safe, and on this rule none of them were.

Tests

65 tests pass in moshpit-resolve.test.ts + moshpit.test.js, including new coverage for the rule on both sides.

Release tagging (v*) is left alone — cut it from main after this merges.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.