@decentnetwork/lan 0.1.137 → 0.1.139

package/dist/carrier/peer-manager.d.ts

@@ -18,6 +18,9 @@ export interface PeerManagerOptions {
     nickname?: string;
     /** Status-message / short bio advertised to friends (Carrier USERINFO descr). */
     statusMessage?: string;
+    /** Directory for persisting partially-received files so a dropped/restarted
+     *  transfer resumes instead of restarting (断点续传). */
+    fileResumeDir?: string;
 }
 export declare class PeerManager extends EventEmitter {
     private peer;
@@ -185,6 +188,13 @@ export declare class PeerManager extends EventEmitter {
      * (162, lossless). Replaces the old `DORA:`-prefixed text on packet 64.
      */
     sendDora(userid: string, text: string): Promise<void>;
+    /**
+     * Report to `pubkey` the delivered rate (bytes/sec) we're measuring on their
+     * inbound IP flow, so they can pace their sends to us toward it. Lossless +
+     * tiny (4 bytes). Best-effort: a failed report just means the sender keeps
+     * its previous pace estimate.
+     */
+    sendRateReport(pubkey: string, bytesPerSec: number): Promise<void>;
     /**
      * Route a decoded decentlan frame to its packet-session, creating or
      * replacing the session on a HANDSHAKE_REQ (handles the Carrier re-pair

package/dist/carrier/peer-manager.js

@@ -6,7 +6,7 @@ import { Peer } from "@decentnetwork/peer";
 import { EventEmitter } from "events";
 import { PacketSession } from "./packet-session.js";
 import { FrameCodec } from "./frame.js";
-import { FRAME_OPCODE_HANDSHAKE_ACK, PACKET_ID_DL_SESSION, PACKET_ID_DL_DORA, PACKET_ID_DL_IP, } from "./types.js";
+import { FRAME_OPCODE_HANDSHAKE_ACK, PACKET_ID_DL_SESSION, PACKET_ID_DL_DORA, PACKET_ID_DL_IP, PACKET_ID_DL_RATE, } from "./types.js";
 import { Logger } from "../utils/logger.js";
 export class PeerManager extends EventEmitter {
     peer = null;
@@ -32,6 +32,7 @@ export class PeerManager extends EventEmitter {
             // rides a single transport instead of fanning out over UDP + relay +
             // TCP relay (which delivered 3-4 duplicates of every IP packet).
             bulkDataPacketId: PACKET_ID_DL_IP,
+            fileResumeDir: opts.fileResumeDir,
         });
         this.setupEventHandlers();
         this.logger.info("Peer instance created (not yet started)");
@@ -421,6 +422,22 @@ export class PeerManager extends EventEmitter {
         }
         await this.peer.sendCustomPacket(userid, PACKET_ID_DL_DORA, Buffer.from(text, "utf-8"));
     }
+    /**
+     * Report to `pubkey` the delivered rate (bytes/sec) we're measuring on their
+     * inbound IP flow, so they can pace their sends to us toward it. Lossless +
+     * tiny (4 bytes). Best-effort: a failed report just means the sender keeps
+     * its previous pace estimate.
+     */
+    async sendRateReport(pubkey, bytesPerSec) {
+        if (!this.peer)
+            return;
+        const buf = Buffer.alloc(4);
+        buf.writeUInt32BE(Math.max(0, Math.min(0xffffffff, Math.round(bytesPerSec))), 0);
+        try {
+            await this.peer.sendCustomPacket(pubkey, PACKET_ID_DL_RATE, buf);
+        }
+        catch { /* best-effort */ }
+    }
     /**
      * Route a decoded decentlan frame to its packet-session, creating or
      * replacing the session on a HANDSHAKE_REQ (handles the Carrier re-pair
@@ -511,6 +528,13 @@ export class PeerManager extends EventEmitter {
                     this.emit("dora-message", pubkey, Buffer.from(data).toString("utf-8"));
                     return;
                 }
+                if (id === PACKET_ID_DL_RATE) {
+                    if (data.length >= 4) {
+                        const bytesPerSec = Buffer.from(data.buffer, data.byteOffset, 4).readUInt32BE(0);
+                        this.emit("rate-report", pubkey, bytesPerSec);
+                    }
+                    return;
+                }
                 if (id === PACKET_ID_DL_IP || id === PACKET_ID_DL_SESSION) {
                     const frame = FrameCodec.decode(data);
                     if (!frame) {

package/dist/carrier/types.d.ts

@@ -11,3 +11,4 @@ export declare const FRAME_HEADER_SIZE = 6;
 export declare const PACKET_ID_DL_SESSION = 161;
 export declare const PACKET_ID_DL_DORA = 162;
 export declare const PACKET_ID_DL_IP = 163;
+export declare const PACKET_ID_DL_RATE = 164;

package/dist/carrier/types.js

@@ -25,3 +25,9 @@ export const PACKET_ID_DL_DORA = 162; // lossless: dora control (must arrive)
 // The TCP-over-TCP cost on a direct path is the accepted trade — relay delivery
 // is non-negotiable. (The handshake at 161 already exempts IP from chat-64.)
 export const PACKET_ID_DL_IP = 163; // lossless: IP data frames (must traverse relays)
+// lossless: egress pacing feedback. The RECEIVER of an IP flow measures how many
+// bytes/sec it actually received from a peer and reports that number back; the
+// SENDER paces its outbound to that peer toward the reported (delivered) rate,
+// so it stops overrunning the path and inducing congestion drops. Payload: a
+// single uint32be = delivered bytes/sec. Rare + tiny, so lossless is free.
+export const PACKET_ID_DL_RATE = 164;

package/dist/cli/commands.d.ts

@@ -218,6 +218,27 @@ export declare function cmdProxyRevokeHost(args: {
 export declare function cmdProxyListHosts(args: {
     configDir?: string;
 }): Promise<void>;
+/**
+ * `agentnet proxy who` — show who is using THIS node's exit right now:
+ * per-client active tunnels, total tunnels opened, bytes moved, and refusals.
+ * Reads live stats from the running daemon (diag → proxy). Lets an exit
+ * operator spot a heavy user before deciding to `agentnet revoke` them.
+ */
+export declare function cmdProxyWho(args: {
+    configDir?: string;
+}): Promise<void>;
+/**
+ * `agentnet proxy block|allow <peer>` — live per-peer exit access control.
+ * Under the default "allow" policy, every friend can tunnel through this exit;
+ * `block` adds a deny rule on the proxy port (applied to the running daemon
+ * instantly, no restart), `allow` removes it. Accepts a userid or a friendly
+ * name (resolved via the live roster).
+ */
+export declare function cmdProxyAccess(args: {
+    peer: string;
+    allow: boolean;
+    configDir?: string;
+}): Promise<void>;
 /**
  * Print the env-var line for a peer to use this node's proxy.
  */
@@ -309,6 +330,7 @@ export declare function cmdProxyRouter(args: {
     all?: boolean;
     routes?: string;
     egress?: string;
+    hlsAccel?: boolean;
     configDir?: string;
 }): Promise<void>;
 /**

package/dist/cli/commands.js

@@ -1040,6 +1040,102 @@ export async function cmdProxyListHosts(args) {
     for (const h of allowHosts)
         console.log(`  ${h}`);
 }
+/**
+ * `agentnet proxy who` — show who is using THIS node's exit right now:
+ * per-client active tunnels, total tunnels opened, bytes moved, and refusals.
+ * Reads live stats from the running daemon (diag → proxy). Lets an exit
+ * operator spot a heavy user before deciding to `agentnet revoke` them.
+ */
+export async function cmdProxyWho(args) {
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    const config = await ConfigLoader.load(resolve(dir, "config.yaml"));
+    const pid = daemonPid(config);
+    if (pid === null) {
+        console.error("No running daemon found for this config — start it with 'agentnet up'.");
+        process.exit(1);
+    }
+    const res = await ipcCall(config, { op: "diag" });
+    if (!res.ok)
+        throw new Error(`Daemon diag failed: ${res.error}`);
+    const proxy = res.data?.proxy;
+    if (!proxy) {
+        console.log("The CONNECT proxy isn't running on this node (nobody can use it as an exit).");
+        console.log("Enable it with:  agentnet proxy enable");
+        return;
+    }
+    const fmtBytes = (n) => {
+        if (n >= 1024 ** 3)
+            return `${(n / 1024 ** 3).toFixed(2)} GB`;
+        if (n >= 1024 ** 2)
+            return `${(n / 1024 ** 2).toFixed(1)} MB`;
+        if (n >= 1024)
+            return `${(n / 1024).toFixed(0)} KB`;
+        return `${n} B`;
+    };
+    const ago = (ms) => {
+        if (!ms)
+            return "—";
+        const s = Math.max(0, Math.floor((Date.now() - ms) / 1000));
+        if (s < 60)
+            return `${s}s ago`;
+        if (s < 3600)
+            return `${Math.floor(s / 60)}m ago`;
+        return `${Math.floor(s / 3600)}h ago`;
+    };
+    console.log(`Exit proxy: ${proxy.active} active tunnel(s), ${proxy.totalOpened} opened total, ` +
+        `${fmtBytes(proxy.bytesTransferred)} moved, ${proxy.totalRefused} refused.`);
+    if (!proxy.peers.length) {
+        console.log("No clients have used this exit yet.");
+        return;
+    }
+    console.log("");
+    console.log("  CLIENT                 ACTIVE  OPENED   BYTES        REFUSED  LAST");
+    for (const p of proxy.peers) {
+        const who = (p.srcName ? `${p.srcName} (${p.src})` : p.src).padEnd(22).slice(0, 22);
+        console.log(`  ${who} ${String(p.active).padStart(6)}  ${String(p.totalOpened).padStart(6)}  ` +
+            `${fmtBytes(p.bytesTransferred).padEnd(11)}  ${String(p.totalRefused).padStart(7)}  ${ago(p.lastSeenMs)}`);
+    }
+    console.log("");
+    console.log("Cut off a heavy user:  agentnet proxy block <userid-or-name>");
+}
+/**
+ * `agentnet proxy block|allow <peer>` — live per-peer exit access control.
+ * Under the default "allow" policy, every friend can tunnel through this exit;
+ * `block` adds a deny rule on the proxy port (applied to the running daemon
+ * instantly, no restart), `allow` removes it. Accepts a userid or a friendly
+ * name (resolved via the live roster).
+ */
+export async function cmdProxyAccess(args) {
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    const config = await ConfigLoader.load(resolve(dir, "config.yaml"));
+    const pid = daemonPid(config);
+    if (pid === null) {
+        console.error("No running daemon found for this config — start it with 'agentnet up'.");
+        process.exit(1);
+    }
+    // Resolve a friendly name to its userid so the deny rule keys on the stable id.
+    let userid = args.peer;
+    try {
+        const { peers } = await fetchLiveIpam(config);
+        const stripDomain = (s) => s.replace(/\.[A-Za-z][A-Za-z0-9-]*$/, "");
+        const hit = peers.find((p) => p.carrierId === args.peer || p.name === args.peer || p.name === stripDomain(args.peer));
+        if (hit?.carrierId)
+            userid = hit.carrierId;
+    }
+    catch {
+        // fall back to the raw arg — the daemon matches on userid OR name
+    }
+    const res = await ipcCall(config, { op: "proxy-access", userid, enabled: args.allow });
+    if (!res.ok)
+        throw new Error(`Daemon refused: ${res.error}`);
+    if (args.allow) {
+        console.log(`✓ ${args.peer} may use this exit again (block removed, live).`);
+    }
+    else {
+        console.log(`✓ ${args.peer} is now BLOCKED from this exit (live — existing tunnels drop on next reconnect).`);
+        console.log("  Re-allow with:  agentnet proxy allow " + args.peer);
+    }
+}
 /**
  * Print the env-var line for a peer to use this node's proxy.
  */
@@ -1384,6 +1480,9 @@ export async function cmdProxyRouter(args) {
         listenPort: args.port ?? 8889,
         mode,
         egressBindIp,
+        learnedRoutesPath: resolve(dir, "learned-routes.json"),
+        hlsAccel: args.hlsAccel ?? false,
+        configDir: dir,
     });
     // Keep the process alive; the router runs until Ctrl-C / signal.
     await new Promise(() => { });

package/dist/cli/index.js

@@ -10,7 +10,7 @@ import { hideBin } from "yargs/helpers";
 // Belt-and-braces — also raise it here in case the CLI is run directly
 // (e.g. `node dist/cli/index.js` rather than via dist/index.js).
 EventEmitter.defaultMaxListeners = 100;
-import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyUse, cmdProxyRouter, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
+import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyUse, cmdProxyRouter, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
 async function main() {
     await yargs(hideBin(process.argv))
         .scriptName("agentnet")
@@ -317,6 +317,19 @@ async function main() {
     })
         .command("list-hosts", "List the CONNECT host allowlist", (yy) => yy.option("config-dir", { type: "string" }), async (argv) => {
         await cmdProxyListHosts({ configDir: argv["config-dir"] });
+    })
+        .command("who", "Show who is using THIS node's exit (per-peer tunnels + bytes)", (yy) => yy.option("config-dir", { type: "string" }), async (argv) => {
+        await cmdProxyWho({ configDir: argv["config-dir"] });
+    })
+        .command("block <peer>", "Block a peer from using THIS node's exit (live, no restart)", (yy) => yy
+        .positional("peer", { type: "string", demandOption: true })
+        .option("config-dir", { type: "string" }), async (argv) => {
+        await cmdProxyAccess({ peer: argv.peer, allow: false, configDir: argv["config-dir"] });
+    })
+        .command("allow <peer>", "Re-allow a previously-blocked peer to use THIS node's exit (live)", (yy) => yy
+        .positional("peer", { type: "string", demandOption: true })
+        .option("config-dir", { type: "string" }), async (argv) => {
+        await cmdProxyAccess({ peer: argv.peer, allow: true, configDir: argv["config-dir"] });
     })
         .command("use", "Print env vars to route HTTPS via a peer's proxy node", (yy) => yy
         .option("peer", { type: "string", demandOption: true, describe: "Peer name or carrier ID" })
@@ -335,6 +348,7 @@ async function main() {
         .option("mode", { choices: ["loadbalance", "failover"], default: "loadbalance" })
         .option("all", { type: "boolean", default: false, describe: "Route ALL hosts through exits (default: China-only split tunnel)" })
         .option("egress", { type: "string", describe: "Bind the DIRECT internet dial to the physical NIC: 'physical' (auto) or an explicit source IPv4 — keeps egress off Tailscale/overlay" })
+        .option("hls-accel", { type: "boolean", default: false, describe: "Accelerate China video streams: selectively MITM video-CDN HTTPS to parallel-prefetch HLS segments across all exits (prints a CA cert to trust once)" })
         .option("config-dir", { type: "string" }), async (argv) => {
         await cmdProxyRouter({
             exit: argv.exit,
@@ -344,6 +358,7 @@ async function main() {
             mode: argv.mode,
             all: argv.all,
             egress: argv.egress,
+            hlsAccel: argv["hls-accel"],
             configDir: argv["config-dir"],
         });
     })

package/dist/daemon/ipc.d.ts

@@ -84,6 +84,12 @@ export interface IpcHandlers {
      *  restart (which drops every Carrier session). Returns the applied
      *  allowlist for the CLI to echo. */
     proxyReload: () => Promise<Record<string, unknown>>;
+    /** Block or allow a specific peer's access to THIS node's exit proxy port,
+     *  LIVE (mutates the running ACL + persists policy.yaml). `allow=true`
+     *  removes the block; `allow=false` adds a deny rule so the peer can no
+     *  longer tunnel through this exit. Lets an operator cut off a heavy user
+     *  without restarting the daemon. */
+    proxyAccess: (userid: string, allow: boolean) => Promise<Record<string, unknown>>;
     /** Re-exec the running daemon with its original argv. The new
      *  process inherits the current process's privileges (so a
      *  root-owned daemon re-execs as root with no sudo prompt),
@@ -94,7 +100,7 @@ export interface IpcHandlers {
     selfRestart: () => Promise<Record<string, unknown>>;
 }
 export interface IpcRequest {
-    op: "friend-request" | "ping" | "diag" | "friends-pending" | "friends-accept" | "friends-reject" | "chat-send" | "chat-history" | "friends-list" | "friend-remove" | "friend-set-alias" | "friends-autoaccept" | "set-profile" | "file-send" | "chat-mark-read" | "subscribe" | "sign" | "proxy-reload" | "self-restart";
+    op: "friend-request" | "ping" | "diag" | "friends-pending" | "friends-accept" | "friends-reject" | "chat-send" | "chat-history" | "friends-list" | "friend-remove" | "friend-set-alias" | "friends-autoaccept" | "set-profile" | "file-send" | "chat-mark-read" | "subscribe" | "sign" | "proxy-reload" | "proxy-access" | "self-restart";
     address?: string;
     hello?: string;
     userid?: string;

package/dist/daemon/ipc.js

@@ -233,6 +233,10 @@ export class IpcServer {
             }
             case "proxy-reload":
                 return await this.handlers.proxyReload();
+            case "proxy-access":
+                if (!req.userid)
+                    throw new Error("proxy-access requires a userid");
+                return await this.handlers.proxyAccess(req.userid, req.enabled !== false);
             case "self-restart":
                 return await this.handlers.selfRestart();
             default:

package/dist/daemon/server.js

@@ -283,6 +283,9 @@ export class DaemonServer {
                 // instead of the generic "@decentnetwork/peer".
                 nickname: this.config.node.name,
                 statusMessage: this.config.node.statusMessage,
+                // Persist partially-received files so a dropped/restarted transfer
+                // resumes instead of restarting from 0 (断点续传).
+                fileResumeDir: resolve(this.configDir, "downloads", ".partial"),
             });
             await this.peerManager.start();
             this.logger.info(`Identity: ${this.peerManager.getAddress()}`);
@@ -507,6 +510,33 @@ export class DaemonServer {
                     }
                     return { applied: true, allowHosts };
                 },
+                proxyAccess: async (userid, allow) => {
+                    // Live block/allow a peer's access to THIS node's exit proxy port.
+                    // Mutates the running ACL (evaluated per-packet, so it's instant) and
+                    // persists policy.yaml. Under the default "allow" policy, a friend can
+                    // use the exit unless we add an explicit DENY — so "block" adds a deny
+                    // rule on the proxy port and "allow" removes the peer's rules.
+                    if (!this.policy)
+                        throw new Error("ACL policy not initialised");
+                    const port = this.config.proxy?.port ?? 8888;
+                    // Accept a userid or a friendly name; store the rule under whatever
+                    // identifier the ACL matches on (both are checked at evaluate time).
+                    const peerKey = userid;
+                    if (allow) {
+                        this.policy.removePeer(peerKey);
+                    }
+                    else {
+                        this.policy.addRule({
+                            peer: peerKey,
+                            direction: "both",
+                            deny: [{ proto: "tcp", port, purpose: "exit-block" }],
+                            audit: true,
+                        });
+                    }
+                    await this.policy.save();
+                    this.logger.info(`Exit access ${allow ? "ALLOWED" : "BLOCKED"} for ${peerKey.slice(0, 12)} (tcp:${port})`);
+                    return { applied: true, userid: peerKey, allowed: allow, port };
+                },
                 selfRestart: async () => {
                     // Detach a child process that waits briefly and then re-execs
                     // the same argv we were started with. Inherits privileges
@@ -586,6 +616,10 @@ export class DaemonServer {
                             session: this.peerManager?.getSessionStatus(f.pubkey) ?? null,
                         })),
                         ipam: ipamPeers,
+                        // Exit-operator view: live per-client usage of THIS node's CONNECT
+                        // proxy (who's tunnelling through me + how much). Null when the
+                        // proxy isn't running.
+                        proxy: this.connectProxy?.getStats() ?? null,
                     };
                 },
             });
@@ -877,6 +911,10 @@ export class DaemonServer {
                 peerManager: this.peerManager,
                 ipam: this.ipam,
                 acl: this.aclEngine,
+                // Pace + fair-queue egress IP data (default on). Disable with
+                // `forwarding: { paced: false }` in config.yaml to restore the old
+                // fire-immediately behavior.
+                pacedForwarding: this.config.forwarding?.paced !== false,
             });
             await this.packetRouter.start();
             // 7b. In-process DNS server. Answers A/PTR for *.{dnsDomain}

package/dist/proxy/connect-proxy.d.ts

@@ -51,6 +51,17 @@ export interface ConnectProxyOptions {
         bytesTransferred: number;
     }) => void;
 }
+/** Per-client (per source virtual-IP) usage of the exit, so the operator can
+ *  see WHO is using their exit and HOW MUCH — spot heavy/abusive users. */
+export interface ProxyPeerUsage {
+    src: string;
+    srcName?: string;
+    active: number;
+    totalOpened: number;
+    totalRefused: number;
+    bytesTransferred: number;
+    lastSeenMs: number;
+}
 export interface ConnectProxyStats {
     bindIp: string;
     port: number;
@@ -59,13 +70,19 @@ export interface ConnectProxyStats {
     totalOpened: number;
     totalRefused: number;
     bytesTransferred: number;
+    /** Per-client breakdown, heaviest (by bytes) first. */
+    peers: ProxyPeerUsage[];
 }
 export declare class ConnectProxy {
     private opts;
     private server;
     private logger;
     private stats;
+    /** Live per-client usage, keyed by source virtual IP. */
+    private perPeer;
     constructor(opts: ConnectProxyOptions);
+    /** Get-or-create the per-client usage row for a source IP. */
+    private peerRow;
     start(): Promise<void>;
     stop(): Promise<void>;
     getStats(): ConnectProxyStats;

package/dist/proxy/connect-proxy.js

@@ -27,6 +27,8 @@ export class ConnectProxy {
     server = null;
     logger;
     stats;
+    /** Live per-client usage, keyed by source virtual IP. */
+    perPeer = new Map();
     constructor(opts) {
         this.opts = opts;
         this.logger = new Logger({ prefix: "ConnectProxy" });
@@ -38,8 +40,20 @@ export class ConnectProxy {
             totalOpened: 0,
             totalRefused: 0,
             bytesTransferred: 0,
+            peers: [],
         };
     }
+    /** Get-or-create the per-client usage row for a source IP. */
+    peerRow(src, srcName) {
+        let row = this.perPeer.get(src);
+        if (!row) {
+            row = { src, srcName, active: 0, totalOpened: 0, totalRefused: 0, bytesTransferred: 0, lastSeenMs: 0 };
+            this.perPeer.set(src, row);
+        }
+        if (srcName && !row.srcName)
+            row.srcName = srcName;
+        return row;
+    }
     async start() {
         if (this.server) {
             throw new Error("ConnectProxy already started");
@@ -84,7 +98,10 @@ export class ConnectProxy {
         this.logger.info("Stopped");
     }
     getStats() {
-        return { ...this.stats };
+        const peers = [...this.perPeer.values()]
+            .sort((a, b) => b.bytesTransferred - a.bytesTransferred || b.totalOpened - a.totalOpened)
+            .map((p) => ({ ...p }));
+        return { ...this.stats, peers };
     }
     /**
      * Update the host allowlist (and optionally the port allowlist) of a
@@ -139,6 +156,10 @@ export class ConnectProxy {
             clientSocket.destroy();
             this.stats.active = Math.max(0, this.stats.active - 1);
             this.stats.bytesTransferred += bytes;
+            const row = this.peerRow(src, srcName);
+            row.active = Math.max(0, row.active - 1);
+            row.bytesTransferred += bytes;
+            row.lastSeenMs = Date.now();
             this.opts.onTunnelClose?.({
                 src,
                 srcName,
@@ -161,6 +182,10 @@ export class ConnectProxy {
             }
             this.stats.active += 1;
             this.stats.totalOpened += 1;
+            const row = this.peerRow(src, srcName);
+            row.active += 1;
+            row.totalOpened += 1;
+            row.lastSeenMs = Date.now();
             this.opts.onTunnelOpen?.({ src, srcName, target: `${host}:${port}` });
             this.logger.info(`tunnel open  ${src}${srcName ? ` (${srcName})` : ""} -> ${host}:${port}`);
         });
@@ -208,6 +233,9 @@ export class ConnectProxy {
     }
     refuse(clientSocket, src, srcName, target, code, reason) {
         this.stats.totalRefused += 1;
+        const row = this.peerRow(src, srcName);
+        row.totalRefused += 1;
+        row.lastSeenMs = Date.now();
         this.logger.info(`tunnel refused ${src}${srcName ? ` (${srcName})` : ""} -> ${target}: ${reason}`);
         try {
             const statusText = code === 400 ? "Bad Request" : "Forbidden";

package/dist/proxy/data/chnroutes-cn.d.ts

@@ -0,0 +1 @@
+export declare const CN_IPV4_RANGES: readonly number[];