@decentnetwork/lan 0.1.149 → 0.1.150

package/dist/proxy/connect-proxy.js

@@ -131,9 +131,17 @@ export class ConnectProxy {
         }
         const host = m[1];
         const port = Number(m[2]);
-        const allowedPorts = this.opts.allowConnectPorts ?? [443, 80];
-        if (!allowedPorts.includes(port)) {
-            this.refuse(clientSocket, src, srcName, `${host}:${port}`, 403, `port ${port} not in allowConnectPorts`);
+        // Port policy: an EXPLICIT allowConnectPorts restricts to that list; UNSET
+        // (the default) allows any port except known-abuse ones (SMTP). The old
+        // default of [443,80] silently broke real apps that use non-standard ports
+        // (verified: the CCTV/Migu app's uem.migu.cn:18088 got 403'd here while the
+        // host itself was perfectly reachable). These are friend-gated private
+        // exits, so blanket port blocking bought little and cost app compatibility.
+        const DENY_PORTS = new Set([25, 465, 587]); // SMTP — block spam relay abuse
+        const allowedPorts = this.opts.allowConnectPorts;
+        const portBlocked = allowedPorts ? !allowedPorts.includes(port) : DENY_PORTS.has(port);
+        if (portBlocked) {
+            this.refuse(clientSocket, src, srcName, `${host}:${port}`, 403, `port ${port} not permitted`);
             return;
         }
         const allowHosts = this.opts.allowHosts ?? [];

package/dist/proxy/multi-exit-router.js

@@ -386,8 +386,14 @@ export function startMultiExitRouter(opts) {
         // Unmeasured exits assume the region's median (or a neutral default) so a
         // new exit is tried but doesn't monopolize before it's proven.
         const measuredVals = pool.map((e) => e.speedEwma).filter((v) => v !== null).sort((a, b) => a - b);
-        const medianBps = measuredVals.length > 0 ? measuredVals[Math.floor(measuredVals.length / 2)] : 2_000_000;
-        const score = (e) => (e.speedEwma ?? medianBps) / (e.active + 1);
+        // Unmeasured exits get a PESSIMISTIC assumption (the region's slowest proven
+        // speed, or a low floor) — NOT the median. A long-lived video tunnel pins to
+        // ONE exit for its whole duration, so it must land on a PROVEN-fast exit, not
+        // an unproven one that might turn out to be 0.3 Mbps and stall the player.
+        // Unproven exits still get overflow traffic once the proven ones fill up,
+        // which measures them safely without risking the video.
+        const unprovenBps = measuredVals.length > 0 ? measuredVals[0] : 800_000;
+        const score = (e) => (e.speedEwma ?? unprovenBps) / (e.active + 1);
         return [...pool].sort((a, b) => score(b) - score(a) || a.served - b.served);
     }
     // Whether ANY exit is configured for a region (healthy or not). Lets us tell
@@ -399,11 +405,16 @@ export function startMultiExitRouter(opts) {
     function forward(exit, target, client, head, onFail) {
         const up = net.connect(exit.port, exit.host);
         let established = false;
-        const fail = (why) => {
+        const fail = (why, tripExit = true) => {
             if (!established) {
-                // Couldn't even establish → an instability signal for the breaker, then
-                // fail over to the next exit.
-                recordStall(exit, why);
+                // Only a CONNECTION-level failure (exit unreachable: timeout / conn
+                // error) is an EXIT fault → feed the breaker. An UPSTREAM status (the
+                // exit answered but the ORIGIN returned 502/403/etc.) is the origin's
+                // problem — it fails identically on every exit, so tripping the exit for
+                // it churns the whole pool (a single dead host like sdc3.10086.cn or
+                // uem.migu.cn was knocking out all 6 China exits). Just fail over.
+                if (tripExit)
+                    recordStall(exit, why);
                 up.destroy();
                 onFail(why);
             }
@@ -499,7 +510,8 @@ export function startMultiExitRouter(opts) {
                 up.on("error", () => client.destroy());
             }
             else {
-                fail(`upstream ${status}`);
+                // Exit answered but the ORIGIN errored (502/403/…) — not an exit fault.
+                fail(`upstream ${status}`, false);
             }
         };
         up.on("data", onData);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.149",
+  "version": "0.1.150",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",