dsh-moli

LIMITATIONS

Known limitations

- **The Linux and macOS paths were written, and the maintainer's own hardware cannot run them.** The maintainer is a student with no macOS or Linux machine, so engine discovery at the POSIX locations and the `sh` installer route came from [@nd002723](https://github.com/nd002723). Linux was verified by them on Ubuntu 24.04; macOS is now covered by CI, which installs the official darwin build and runs the page-level suites on `macos-latest` (Apple Silicon, arm64) — see [Platform support](#platform-support) for exactly what that exercised. **A CI runner is not a desktop, so if something fails on either platform, please open an [issue](https://github.com/27painter/dsh-moli/issues) with the error output** — that is still the only way the paths users actually take get fixed. - **Moli itself is not bundled.** Install it separately or let `moli_probe action=install` fetch it. - **Only `fetch` is wrapped.** `moli serve` (CDP/WebDriver server) and `moli import` (session import) are not exposed as tools yet. - **No per-call cancellation for fetches.** The engine runs synchronously for a fetch, so an interrupted turn cannot abort it mid-flight; a call already in progress finishes and its artifact is written. `moli_probe action=install` is the exception — it is asynchronous and aborts the child immediately on an interrupted turn. - **HTTP error status is only visible for `dump: json`.** That is the only dump format carrying the status field. With `markdown` or `html` an error page is returned as content. - **`writeTo` calls are serialized.** They report as unsafe to parallelize, so two artifact writes never interleave. - **`insecureTls` defaults to `true`.** Behind a filtering proxy the certificate-revocation responder is often unreachable, and Schannel then fails with `CRYPT_E_REVOCATION_OFFLINE (0x80092013)` on hosts like GitHub. The default passes moli's `--insecure-disable-tls-host-verification`. Set `insecureTls: false` on networks where revocation checks work, or per call with `insecureTls: false`. - **Sandbox interaction.** Under DSH's default file sandbox, a subprocess runs at low integrity and Schannel cannot acquire client credentials, so HTTPS fails with `SEC_E_NO_CREDENTIALS`. Plain HTTP still works and the failure is reported structurally (`sandboxTlsBlock: true`) with the retry path; passing `sandbox_permissions: "danger-full-access"` for that call resolves it. - **Host reachability varies on some networks.** Observed on the development machine: `curl`-based clients (Moli) timed out on `github.com` while `git` over HTTPS and the system browser reached it in seconds, and `api.github.com` worked where `github.com` did not — at the same moment. Treat a timeout as possibly transient: retry, or set `proxy`. Because a bare timeout is ambiguous, it is reported as `possiblyUnreachable` rather than a verdict. The install action's multi-route fallback and the manual commands above exist for exactly this case.