@decentnetwork/lan 0.1.14 → 0.1.16

package/dist/cli/commands.d.ts

@@ -15,9 +15,6 @@ export declare function cmdInit(args: {
 export declare function cmdIdentityShow(args: {
     configDir?: string;
 }): Promise<void>;
-/**
- * List peers from IPAM
- */
 export declare function cmdPeersList(args: {
     configDir?: string;
 }): Promise<void>;

package/dist/cli/commands.js

@@ -11,7 +11,6 @@ import { Ipam } from "../ipam/ipam.js";
 import { Policy } from "../acl/policy.js";
 import { AclEngine } from "../acl/acl-engine.js";
 import { AuditLog } from "../acl/audit.js";
-import { DnsResolver } from "../dns/resolver.js";
 /**
  * Refuse to open a second Carrier peer with this identity if the
  * daemon is already running with the same keypair. Two peers sharing
@@ -162,29 +161,51 @@ export async function cmdIdentityShow(args) {
 /**
  * List peers from IPAM
  */
+/**
+ * Fetch the IPAM contents from wherever they're live. When the daemon
+ * is up, dora-merged entries live in the daemon's memory only — reading
+ * the on-disk file gives the operator a stale (often empty) snapshot.
+ * The daemon publishes the in-memory list over IPC via `diag`. Falls
+ * back to disk when the daemon is down.
+ */
+async function fetchLiveIpam(config) {
+    if (daemonPid(config) !== null) {
+        const res = await ipcCall(config, { op: "diag" });
+        if (res.ok) {
+            const data = res.data;
+            return { peers: data.ipam ?? [], source: "daemon" };
+        }
+    }
+    const ipam = await Ipam.loadOrCreate(config.paths.ipamFile, config.node.namespace);
+    return {
+        peers: ipam.getPeers().map((p) => ({
+            name: p.name,
+            virtualIp: p.virtualIp,
+            carrierId: p.carrierId,
+        })),
+        source: "disk",
+    };
+}
 export async function cmdPeersList(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();
     const config = await ConfigLoader.load(resolve(dir, "config.yaml"));
-    const ipam = await Ipam.loadOrCreate(config.paths.ipamFile, config.node.namespace);
-    const peers = ipam.getPeers();
+    const { peers, source } = await fetchLiveIpam(config);
     if (peers.length === 0) {
-        console.log("No peers configured. Use 'agentnet ipam assign' to add peers.");
+        if (source === "daemon") {
+            console.log("Daemon up but IPAM is empty — dora roster hasn't merged yet, or dora isn't configured.");
+        }
+        else {
+            console.log("No peers configured. Daemon is down — use 'agentnet ipam assign' to add peers,");
+            console.log("or 'agentnet up' to start the daemon (dora will populate IPAM automatically).");
+        }
         return;
     }
-    console.log(`Peers (${peers.length}):`);
+    console.log(`Peers (${peers.length}) ${source === "daemon" ? "[live]" : "[disk]"}:`);
     console.log("");
     for (const peer of peers) {
-        const expires = peer.expiresAt
-            ? ` (expires ${new Date(peer.expiresAt).toISOString()})`
-            : "";
         console.log(`  ${peer.name}.${config.network.dnsDomain}`);
         console.log(`    Virtual IP: ${peer.virtualIp}`);
         console.log(`    Carrier ID: ${peer.carrierId.slice(0, 32)}...`);
-        if (peer.services.length > 0) {
-            console.log(`    Services: ${peer.services.map((s) => `${s.name}:${s.port}`).join(", ")}`);
-        }
-        if (expires)
-            console.log(`    ${expires.trim()}`);
         console.log("");
     }
 }
@@ -282,16 +303,29 @@ export async function cmdRevoke(args) {
 export async function cmdResolve(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();
     const config = await ConfigLoader.load(resolve(dir, "config.yaml"));
-    const ipam = await Ipam.loadOrCreate(config.paths.ipamFile, config.node.namespace);
-    const resolver = new DnsResolver(ipam, config.network.dnsDomain);
-    const ip = resolver.resolve(args.name);
-    if (ip) {
-        console.log(`${args.name} -> ${ip}`);
-    }
-    else {
-        console.log(`Cannot resolve: ${args.name}`);
-        process.exit(1);
+    // Prefer the live daemon's IPAM — the on-disk ipam.yaml is empty
+    // until the operator runs `agentnet ipam assign` manually, but dora
+    // populates the daemon's in-memory IPAM with the full roster.
+    // Falls back to disk when the daemon is down.
+    const { peers } = await fetchLiveIpam(config);
+    const stripped = args.name.endsWith(`.${config.network.dnsDomain}`)
+        ? args.name.slice(0, -(config.network.dnsDomain.length + 1))
+        : args.name;
+    const byName = peers.find((p) => p.name === stripped);
+    const byIp = peers.find((p) => p.virtualIp === args.name);
+    const byCarrier = peers.find((p) => p.carrierId === args.name);
+    const hit = byName ?? byIp ?? byCarrier;
+    if (hit) {
+        if (byIp) {
+            console.log(`${args.name} -> ${hit.name} (${hit.carrierId.slice(0, 16)}...)`);
+        }
+        else {
+            console.log(`${args.name} -> ${hit.virtualIp}`);
+        }
+        return;
     }
+    console.log(`Cannot resolve: ${args.name}`);
+    process.exit(1);
 }
 /**
  * Show daemon status (must be run while daemon is up — placeholder for now)
@@ -529,26 +563,58 @@ export async function cmdFriendsPending(args) {
     if (daemonPid(config) === null) {
         throw new Error("Daemon not running — pending friend-requests are held by the daemon. Start it with 'agentnet up' first.");
     }
-    const res = await ipcCall(config, { op: "friends-pending" });
-    if (!res.ok)
-        throw new Error(`Daemon refused: ${res.error}`);
-    const list = res.data?.pending ?? [];
-    if (list.length === 0) {
-        console.log("No pending friend-requests.");
+    // Two sources of "in-flight" friend state, both useful to the
+    // operator under one command:
+    //   1) inbound — peers who sent us a friend-request that hasn't
+    //      been accepted yet. Auto-accept (default) drains this
+    //      instantly, so the inbound list is usually empty.
+    //   2) outbound — peers WE sent a request to who haven't
+    //      accepted; the SDK's friends() returns these with
+    //      status="requested". Useful for "is my friend-request
+    //      stuck?" debugging.
+    const [pendingRes, diagRes] = await Promise.all([
+        ipcCall(config, { op: "friends-pending" }),
+        ipcCall(config, { op: "diag" }),
+    ]);
+    if (!pendingRes.ok)
+        throw new Error(`Daemon refused: ${pendingRes.error}`);
+    if (!diagRes.ok)
+        throw new Error(`Daemon diag failed: ${diagRes.error}`);
+    const inbound = pendingRes.data?.pending ?? [];
+    const friends = diagRes.data.friends ?? [];
+    const outbound = friends.filter((f) => f.status === "requested");
+    if (inbound.length === 0 && outbound.length === 0) {
+        console.log("No friend-requests in flight.");
+        console.log("  inbound:  none queued (autoAccept handles them automatically)");
+        console.log("  outbound: every sent request has been accepted");
         return;
     }
-    console.log(`Pending friend-requests (${list.length}):`);
-    for (const e of list) {
+    if (inbound.length > 0) {
+        console.log(`Inbound (waiting for your accept) — ${inbound.length}:`);
+        for (const e of inbound) {
+            console.log("");
+            console.log(`  ${e.name || "(unnamed)"}`);
+            console.log(`    userid:  ${e.userid}`);
+            if (e.hello)
+                console.log(`    hello:   ${e.hello}`);
+            console.log(`    arrived: ${e.arrivedAt}`);
+        }
+        console.log("");
+        console.log("  Accept:  agentnet friends accept --userid <USERID>");
+        console.log("  Reject:  agentnet friends reject --userid <USERID>");
         console.log("");
-        console.log(`  ${e.name || "(unnamed)"}`);
-        console.log(`    userid:  ${e.userid}`);
-        if (e.hello)
-            console.log(`    hello:   ${e.hello}`);
-        console.log(`    arrived: ${e.arrivedAt}`);
     }
-    console.log("");
-    console.log("Accept with:  agentnet friends accept --userid <USERID>");
-    console.log("Reject with:  agentnet friends reject --userid <USERID>");
+    if (outbound.length > 0) {
+        console.log(`Outbound (we requested, peer hasn't accepted yet) — ${outbound.length}:`);
+        for (const f of outbound) {
+            const id = f.carrierId || f.pubkey;
+            console.log(`  ${f.name || "(no name)"}  userid: ${id}`);
+        }
+        console.log("");
+        console.log("  These resolve automatically once the recipient's daemon comes up");
+        console.log("  and accepts. If a peer never accepts, re-send via:");
+        console.log("    agentnet friend-request --address <ADDRESS>");
+    }
 }
 /**
  * Accept a queued friend-request by userid. Routes through IPC;

package/dist/cli/index.js

@@ -26,7 +26,14 @@ async function main() {
         .command("peers list", "List configured peers", (y) => y.option("config-dir", { type: "string" }), async (argv) => {
         await cmdPeersList({ configDir: argv["config-dir"] });
     })
-        .command("ipam assign", "Register peer with virtual IP", (y) => y
+        // Nested so 'ipam list' (user-expected) doesn't get routed to
+        // 'ipam assign' by yargs' flat-positional matching. Same trap
+        // 'friends' fell into.
+        .command("ipam", "Manage IP address allocations (run 'agentnet ipam --help')", (y) => y
+        .command("list", "List peer IP allocations (live from daemon if up)", (yy) => yy.option("config-dir", { type: "string" }), async (argv) => {
+        await cmdPeersList({ configDir: argv["config-dir"] });
+    })
+        .command("assign", "Register peer with virtual IP", (yy) => yy
         .option("peer", { type: "string", demandOption: true, describe: "Carrier ID" })
         .option("ip", { type: "string", describe: "Virtual IP (auto if omitted)" })
         .option("name", { type: "string", demandOption: true, describe: "Hostname" })
@@ -43,6 +50,9 @@ async function main() {
             services: argv.service,
             configDir: argv["config-dir"],
         });
+    })
+        .demandCommand(1, "Specify an ipam subcommand (run 'agentnet ipam --help')"), () => {
+        // parent handler — never invoked because demandCommand above
     })
         .command("grant", "Grant access to a peer", (y) => y
         .option("peer", { type: "string", demandOption: true })
@@ -152,8 +162,15 @@ async function main() {
         .demandCommand(1, "Specify a friends subcommand (run 'agentnet friends --help')"), () => {
         // parent handler — never invoked because demandCommand above
     })
-        .command("audit log", "View audit log", (y) => y.option("tail", { type: "number", default: 50 }).option("config-dir", { type: "string" }), async (argv) => {
+        // Audit is also nested for consistency / future subcommands.
+        .command("audit", "View audit trail (run 'agentnet audit --help')", (y) => y
+        .command("log", "View audit log", (yy) => yy
+        .option("tail", { type: "number", default: 50 })
+        .option("config-dir", { type: "string" }), async (argv) => {
         await cmdAuditLog({ tail: argv.tail, configDir: argv["config-dir"] });
+    })
+        .demandCommand(1, "Specify an audit subcommand (run 'agentnet audit --help')"), () => {
+        // parent handler — never invoked because demandCommand above
     })
         // Proxy commands — nested under a single `proxy` command so yargs
         // builds a proper subcommand tree. Without nesting, the dotted form

package/dist/daemon/server.js

@@ -212,8 +212,15 @@ export class DaemonServer {
                         this.logger.info(`Reconfiguring TUN: dora-allocated IP changed ${currentIp} -> ${newIp}`);
                         const ifname = this.tunDevice.getInterface();
                         try {
-                            await this.routeManager.cleanup(ifname, this.config.network.subnet, currentIp);
+                            // ORDER MATTERS: close TunDevice FIRST so the helper
+                            // subprocess fully exits and releases agentnet0.
+                            // routeManager.cleanup's `ip tuntap del` would otherwise
+                            // fail with EBUSY and the subsequent helper spawn would
+                            // race the kernel for the device name, exit code=1, and
+                            // leave the daemon TUN-less. tunDevice.close() now waits
+                            // for actual process exit.
                             await this.tunDevice.close();
+                            await this.routeManager.cleanup(ifname, this.config.network.subnet, currentIp);
                             this.tunDevice = new TunDevice({
                                 config: {
                                     name: this.config.network.interface,

package/dist/tun/tun-device.js

@@ -54,8 +54,35 @@ export class TunDevice extends EventEmitter {
         this.isOpen = false;
         this.packetQueue = [];
         if (this.helper) {
-            this.helper.kill("SIGTERM");
+            // Wait for the helper subprocess to actually exit before
+            // returning. SIGTERM is async — without this await, a caller
+            // that immediately spawns a new helper for the same device
+            // name races the kernel: the old helper still owns
+            // `agentnet0`, the new helper's TUNSETIFF ioctl returns
+            // EBUSY, the helper exits with code=1, the daemon ends up
+            // with NO TUN device at all even though `systemctl is-active`
+            // reports green. Symptom: every outbound packet routes via
+            // the default gateway instead of the daemon, 100% packet
+            // loss with no obvious error. Force-kill after 2s in case
+            // SIGTERM is swallowed.
+            const helper = this.helper;
             this.helper = undefined;
+            await new Promise((res) => {
+                if (helper.exitCode !== null || helper.signalCode !== null) {
+                    res();
+                    return;
+                }
+                const timer = setTimeout(() => {
+                    if (helper.exitCode === null && helper.signalCode === null) {
+                        helper.kill("SIGKILL");
+                    }
+                }, 2000);
+                helper.once("exit", () => {
+                    clearTimeout(timer);
+                    res();
+                });
+                helper.kill("SIGTERM");
+            });
         }
         this.emit("closed");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",