fix(app): a one-word address is refused at once; this machine's is reached over HTTP

An address of one word (`todo`) was read as https://todo/ and looked for,
the person waiting up to 15 s for no instance to answer. A host is now a
domain of two labels or more, an IP address or localhost; anything else is
"This isn't an address." as it is typed. localhost and loopback addresses
typed without a scheme are reached over HTTP, as a server running on the
same machine has no certificate; HTTPS where typed (the developer's
review, 9 Nov 2026).

Whats-New: An address of a single word is now refused at once, rather than looked for.
Whats-New-De: Eine Adresse aus nur einem Wort wird jetzt sofort abgelehnt, statt danach zu suchen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/lib/src/instance/instance.dart

@@ -11,22 +11,32 @@ final class const Instance._(
 ) with Equatable {
   /// The instance at [address] as a person types it or a build names it:
   /// `learn.example.org`, with `https://` or without, with a port or a path
-  /// or not; null for an address that can't be one.
+  /// or not; null for an address that can't be one. Its host is a domain of
+  /// two labels or more, an IP address, or `localhost`: a single word
+  /// (`todo`) is refused as typed rather than looked for, as no instance on
+  /// the internet has one. Without a scheme it is HTTPS, but on this
+  /// machine, where a server running has no certificate: HTTP (the
+  /// developer's review, 9 Nov 2026).
   static Instance? parse(String address) {
     var text = address.trim();
     if (text.isEmpty || text.contains(RegExp(r'\s'))) {
       return null;
     }
-    if (!text.contains('://')) {
+    final typedScheme = text.contains('://');
+    if (!typedScheme) {
       text = 'https://$text';
     }
-    final url = Uri.tryParse(text);
+    var url = Uri.tryParse(text);
     if (url == null ||
         !(url.isScheme('https') || url.isScheme('http')) ||
         url.host.isEmpty ||
-        url.userInfo.isNotEmpty) {
+        url.userInfo.isNotEmpty ||
+        !_isHost(url.host)) {
       return null;
     }
+    if (!typedScheme && _isThisMachine(url.host)) {
+      url = url.replace(scheme: 'http');
+    }
     final path = url.path.endsWith('/') ? url.path : '${url.path}/';
     return Instance._(
       Uri(
@@ -43,10 +53,19 @@ final class const Instance._(
   /// `::1`), which never leaves it. Plain HTTP anywhere else would let
   /// anyone on the way read and change it: the proofs that sign in, the
   /// keys' wrappings, every request a session carries (ADR 0017).
-  bool get isSecure =>
-      url.isScheme('https') ||
-      url.host == 'localhost' ||
-      (InternetAddress.tryParse(url.host)?.isLoopback ?? false);
+  bool get isSecure => url.isScheme('https') || _isThisMachine(url.host);
+
+  /// Whether [host] is this machine: `localhost`, `127.0.0.0/8` or `::1`.
+  static bool _isThisMachine(String host) =>
+      host.toLowerCase() == 'localhost' ||
+      (InternetAddress.tryParse(host)?.isLoopback ?? false);
+
+  /// Whether [host] can be an instance's: an IP address, `localhost`, or a
+  /// domain of two labels or more, none empty.
+  static bool _isHost(String host) =>
+      InternetAddress.tryParse(host) != null ||
+      host.toLowerCase() == 'localhost' ||
+      (host.contains('.') && !host.split('.').any((label) => label.isEmpty));
 
   /// How people know it: its host, with the port if it has one
   /// (`learn.halkyon.eu`, `localhost:8080`).

packages/halkyon_app/test/app/instance_gate_test.dart

@@ -220,6 +220,21 @@ void main() {
     expect(opened, isEmpty);
   });
 
+  testWidgets('a single word is no address, said at once rather than looked '
+      "for (the developer's review, 9 Nov 2026)", (tester) async {
+    await start(tester, answering: {other});
+    await tester.tap(find.text('Another instance'));
+    await tester.pumpAndSettle();
+
+    await tester.enterText(find.byType(TextField), 'todo');
+    await tester.tap(find.text('Continue'));
+    await tester.pump();
+
+    expect(find.text("This isn't an address."), findsOneWidget);
+    expect(find.byType(LinearProgressIndicator), findsNothing);
+    expect(opened, isEmpty);
+  });
+
   testWidgets('an instance kept from before over plain HTTP is never opened: '
       'another is used, or it is removed', (tester) async {
     final insecure = Instance.parse('http://learn.example.net')!;

packages/halkyon_app/test/instance/instance_test.dart

@@ -24,6 +24,31 @@ void main() {
     );
   });
 
+  test('reaches this machine over HTTP where no scheme is typed, as a '
+      "server running on it has no certificate (the developer's review, "
+      '9 Nov 2026)', () {
+    for (final (address, url) in [
+      ('localhost:8080', 'http://localhost:8080/'),
+      ('LOCALHOST', 'http://localhost/'),
+      ('127.0.0.1:8080', 'http://127.0.0.1:8080/'),
+      ('[::1]:8080', 'http://[::1]:8080/'),
+      ('https://localhost:8443', 'https://localhost:8443/'),
+    ]) {
+      expect(Instance.parse(address)?.url, Uri.parse(url), reason: address);
+    }
+  });
+
+  test('takes an IP address as a host', () {
+    expect(
+      Instance.parse('192.168.1.10:8080')?.url,
+      Uri.parse('https://192.168.1.10:8080/'),
+    );
+    expect(
+      Instance.parse('http://[2001:db8::1]')?.url,
+      Uri.parse('http://[2001:db8::1]/'),
+    );
+  });
+
   test('refuses what is no address', () {
     for (final address in [
       '',
@@ -32,6 +57,13 @@ void main() {
       'ftp://example.org',
       'https://',
       'https://someone@example.org',
+      // A host of one word that isn't this machine, which no instance on
+      // the internet has: refused as typed rather than looked for
+      // (the developer's review, 9 Nov 2026).
+      'todo',
+      'https://learn',
+      'learn.',
+      '.org',
     ]) {
       expect(Instance.parse(address), isNull, reason: address);
     }