fix(minimal): stop claiming a box name opens in any browser by norrietaylor · Pull Request #2211 · gominimal/minimal

norrietaylor · 2026-10-14T20:46:28Z

What

With native DNS deployed, the session-start host line (LiveSurface::Native arm of
host_line_beside in crates/minimal/src/resolver.rs) now reads:

names: <box>.min.internal resolves on this machine; open it through the HTTP proxy at 127.0.0.1:<port>

and, when the create reply carries no proxy port, names: <box>.min.internal resolves on this machine.
It was names: <box>.min.internal resolves in any browser on this machine.

Also updated: the host_line doc comment, the resolver unit tests and the tests/cli.rs
assertion that pinned the old words, docs/reference/cli-min.md, and the NET-142 native
requirement in spec 18 that quoted the line.

Why

QA on 0.7.0-rc2 (macOS) found the old line false. The name resolves to a reserved 127.0.64.N
address, but no listener binds that address, and ingress binds only 127.0.0.1:EXT. A browser
that connects to the name gets a refused connection.

The new wording promises resolution only, and names the path that does open the box. The
hostname proxy keeps serving beside native DNS (NET-019) and routes box names:

The native verdict never stops the proxy (crates/minimal/src/cmd/session.rs, the surface
verdict comment: "The proxy keeps serving beside native DNS (NET-019)").
serving_proxy_port comes from the same create reply and is the port the Proxy arm already
prints.
Daemon-side proof: name_surface_reported_when_both_deployed in crates/minimald/src/rpc.rs
routes a box-name request through the proxy after the native verdict, and the
NET-019 test in crates/minimald/src/net/proxy.rs does the same.

Left out

QA also saw the native line for host_ip boxes, whose name answers NOERROR with no records, and
for none boxes, whose name answers NXDOMAIN. The network mode is available at the one
production call site (config.network in cmd/session.rs). Using it would need a new
host_line_beside parameter and per-mode wording. The none case needs wording of its own,
because the proxy has no route to a box that has no network. That is more than a change to this
line, so this PR leaves it. For those modes the line still says "resolves on this machine". The
proxy half of the line is still true for host_ip boxes, which the proxy routes as host-net
boxes.

Verification

cross test --target aarch64-unknown-linux-musl -p minimal host_line:

test resolver::tests::activate_host_line_carries_finish_setup_clause_while_items_missing ... ok
test resolver::tests::activate_host_line_names_native_dns_when_deployed ... ok
test resolver::tests::activate_prints_one_host_line_per_install_state ... ok
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 439 filtered out; finished in 0.13s

Full cross test --target aarch64-unknown-linux-musl -p minimal --no-fail-fast:

lib:        test result: FAILED. 440 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out
main.rs:    test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
bug.rs:     test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
cli.rs:     test result: ok. 74 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
git_remote: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
kani_workflow: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
named_vm:   test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

The two lib failures are tests::a_stopped_vm_does_not_hold_a_box_name_resolution and
tests::legacy_network_spellings_parse_with_hint. Both fail under cross on every branch and are
not related to this change.

just fmt-check is clean. just lint-prose shows no new alerts on the changed lines of
docs/reference/cli-min.md. On the spec requirement line, the only remaining alerts are the
EARS sentence-length warning and the verify: line alerts, which were there before this change.

scripts/session-e2e.sh pinned the old text in two checks (the range-step check and the NET-018 activate check); they now match resolves on this machine. The first CI run failed native-daemon-e2e on that pin.

With native DNS deployed, the session-start host line said `names: <box>.min.internal resolves in any browser on this machine`. The name resolves to a reserved local address, but nothing listens there for a browser, so the connection the line promised is refused. The native arm now claims resolution only and names the path that opens the box: the hostname proxy, which keeps serving beside native DNS (NET-019) and routes box names. With no proxy port the line says only that the name resolves on this machine. Updates the host_line doc, the resolver and cli tests that pinned the old words, the CLI reference, and the NET-142 native requirement.

coderabbitai · 2026-10-14T20:46:38Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: 199d770a-7efb-4f53-a67e-9efc00b82dda

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-14T20:47:52Z

Spec lint

docs/specs/18-spec-box-networking/18-spec-box-networking.md — 11 finding(s)

docs/specs/18-spec-box-networking/18-spec-box-networking.md:159: P004 NET-009 names test 'native_resolution_without_proxy_env', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:339: P004 NET-040 names test 'fresh_install_own_ip_ingress_publishes_loopback', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:344: P004 NET-041 names test 'installer_switch_binary_executable', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:382: P004 NET-048 names test 'linux_amd64_manifest_ships_vm_stack', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:387: P004 NET-049 names test 'fresh_linux_kvm_activate_local_minvmd', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:392: P004 NET-050 names test 'linux_arm64_manifest_ships_vm_stack', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:397: P004 NET-051 names test 'fresh_arm64_kvm_activate_local_minvmd', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:722: P004 NET-139 names test 'vsock_rpc_refuses_non_host_cid', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:739: P004 NET-132 names test 'proxy_sees_each_vm_box_by_its_switch_address', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:765: P004 NET-134 names test 'deny_all_box_reaches_proxy_and_no_other_host_port', which was not found in the repository
docs/specs/18-spec-box-networking/18-spec-box-networking.md:789: P004 NET-107 names test 'session_outbound_request', which was not found in the repository

Advisory. None of this blocks the merge; the review decides.

Advisory, and never a merge gate. Linter: gominimal/foundry@1cc05810, spec format: How Minimal Writes Specs.

minimal-foundry · 2026-10-14T20:48:06Z

Approved: no findings at 728a3b0898ae.

Nothing to do.

Clobber: none: git log on resolver.rs shows no recent fix reverted; the only stale resolves in any browser strings left are prose in docs/spec and e2e echo/comment text, none load-bearing.

minimal-foundry