@decentnetwork/lan 0.1.151 → 0.1.155

package/dist/cli/commands.d.ts

@@ -205,6 +205,25 @@ export declare function cmdProxyAllowHost(args: {
     host: string;
     configDir?: string;
 }): Promise<void>;
+/**
+ * Manage the exit's free-tier whitelist: userids that are always served, even
+ * when the exit is busy (the paid / priority set). `action` is add | remove |
+ * list. Applies live to the running proxy — no restart, no session churn.
+ */
+export declare function cmdProxyWhitelist(args: {
+    action: "add" | "remove" | "list";
+    userid?: string;
+    configDir?: string;
+}): Promise<void>;
+/**
+ * Set (or clear, with 0) the exit's busy threshold in Mbps. Above this smoothed
+ * egress rate the exit serves only whitelisted peers; 0 = free for all.
+ * Applies live to the running proxy.
+ */
+export declare function cmdProxyBusyMbps(args: {
+    mbps: number;
+    configDir?: string;
+}): Promise<void>;
 /**
  * Remove a host glob from the proxy allowlist.
  */

package/dist/cli/commands.js

@@ -976,6 +976,69 @@ export async function cmdProxyAllowHost(args) {
     console.log(`Added '${args.host}' to proxy allow-hosts.`);
     await applyProxyReloadIfRunning(config);
 }
+/**
+ * Manage the exit's free-tier whitelist: userids that are always served, even
+ * when the exit is busy (the paid / priority set). `action` is add | remove |
+ * list. Applies live to the running proxy — no restart, no session churn.
+ */
+export async function cmdProxyWhitelist(args) {
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    const configPath = resolve(dir, "config.yaml");
+    const config = await ConfigLoader.load(configPath);
+    const proxy = config.proxy ?? { enabled: false, port: 8888 };
+    const whitelist = new Set(proxy.whitelist ?? []);
+    if (args.action === "list") {
+        if (whitelist.size === 0) {
+            console.log("Exit whitelist is empty (when busy, no one is prioritized — free users are refused).");
+        }
+        else {
+            console.log(`Exit whitelist (${whitelist.size} always-served userid(s)):`);
+            for (const u of whitelist)
+                console.log(`  - ${u}`);
+        }
+        const busy = proxy.busyMbps ?? 0;
+        console.log(busy > 0
+            ? `Busy threshold: ${busy}Mbps (above this, only whitelisted peers get new tunnels).`
+            : `Busy threshold: OFF — exit is free for all. Set one with 'agentnet proxy busy-mbps <N>'.`);
+        return;
+    }
+    if (!args.userid) {
+        console.log(`A userid is required for '${args.action}'.`);
+        return;
+    }
+    if (args.action === "add") {
+        whitelist.add(args.userid);
+        console.log(`Added ${args.userid} to the exit whitelist (always served, even when busy).`);
+    }
+    else {
+        if (!whitelist.delete(args.userid)) {
+            console.log(`${args.userid} was not on the whitelist.`);
+            return;
+        }
+        console.log(`Removed ${args.userid} from the exit whitelist.`);
+    }
+    config.proxy = { ...proxy, whitelist: [...whitelist] };
+    await ConfigLoader.save(config, configPath);
+    await applyProxyReloadIfRunning(config);
+}
+/**
+ * Set (or clear, with 0) the exit's busy threshold in Mbps. Above this smoothed
+ * egress rate the exit serves only whitelisted peers; 0 = free for all.
+ * Applies live to the running proxy.
+ */
+export async function cmdProxyBusyMbps(args) {
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    const configPath = resolve(dir, "config.yaml");
+    const config = await ConfigLoader.load(configPath);
+    const proxy = config.proxy ?? { enabled: false, port: 8888 };
+    const mbps = Math.max(0, Math.floor(args.mbps));
+    config.proxy = { ...proxy, busyMbps: mbps };
+    await ConfigLoader.save(config, configPath);
+    console.log(mbps > 0
+        ? `Exit busy threshold set to ${mbps}Mbps — above this, only whitelisted peers get new tunnels.`
+        : `Exit busy threshold cleared — the exit is now free for all.`);
+    await applyProxyReloadIfRunning(config);
+}
 /**
  * If the daemon is up, push the freshly-saved proxy allowlist into the
  * running proxy over IPC — no restart, no Carrier-session churn. Prints

package/dist/cli/index.js

@@ -10,7 +10,7 @@ import { hideBin } from "yargs/helpers";
 // Belt-and-braces — also raise it here in case the CLI is run directly
 // (e.g. `node dist/cli/index.js` rather than via dist/index.js).
 EventEmitter.defaultMaxListeners = 100;
-import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyUse, cmdProxyRouter, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
+import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
 async function main() {
     await yargs(hideBin(process.argv))
         .scriptName("agentnet")
@@ -317,6 +317,21 @@ async function main() {
     })
         .command("list-hosts", "List the CONNECT host allowlist", (yy) => yy.option("config-dir", { type: "string" }), async (argv) => {
         await cmdProxyListHosts({ configDir: argv["config-dir"] });
+    })
+        .command("whitelist <action> [userid]", "Free-tier whitelist: userids always served when the exit is busy (add|remove|list)", (yy) => yy
+        .positional("action", { type: "string", demandOption: true })
+        .positional("userid", { type: "string" })
+        .option("config-dir", { type: "string" }), async (argv) => {
+        if (argv.action !== "add" && argv.action !== "remove" && argv.action !== "list") {
+            console.log("Usage: agentnet proxy whitelist <add|remove|list> [userid]");
+            return;
+        }
+        await cmdProxyWhitelist({ action: argv.action, userid: argv.userid, configDir: argv["config-dir"] });
+    })
+        .command("busy-mbps <mbps>", "Set the exit's busy threshold (Mbps); above it, only whitelisted peers get new tunnels. 0 = free for all", (yy) => yy
+        .positional("mbps", { type: "number", demandOption: true })
+        .option("config-dir", { type: "string" }), async (argv) => {
+        await cmdProxyBusyMbps({ mbps: argv.mbps, configDir: argv["config-dir"] });
     })
         .command("who", "Show who is using THIS node's exit (per-peer tunnels + bytes)", (yy) => yy.option("config-dir", { type: "string" }), async (argv) => {
         await cmdProxyWho({ configDir: argv["config-dir"] });

package/dist/daemon/server.js

@@ -541,13 +541,21 @@ export class DaemonServer {
                         };
                     }
                     this.connectProxy.updateAllowlist(allowHosts, allowConnectPorts);
+                    // Also refresh the free-tier admission control (busy threshold +
+                    // whitelist) from the same fresh config, so `proxy whitelist add`
+                    // and `proxy busy-mbps` apply live without a restart.
+                    const whitelist = fresh.proxy?.whitelist ?? [];
+                    const busyMbps = fresh.proxy?.busyMbps;
+                    this.connectProxy.updateAdmission({ whitelist, busyMbps });
                     // Keep the in-memory config in sync so a later diag reflects it.
                     if (this.config.proxy) {
                         this.config.proxy.allowHosts = allowHosts;
                         if (allowConnectPorts)
                             this.config.proxy.allowConnectPorts = allowConnectPorts;
+                        this.config.proxy.whitelist = whitelist;
+                        this.config.proxy.busyMbps = busyMbps;
                     }
-                    return { applied: true, allowHosts };
+                    return { applied: true, allowHosts, whitelist, busyMbps };
                 },
                 proxyAccess: async (userid, allow) => {
                     // Live block/allow a peer's access to THIS node's exit proxy port.
@@ -1031,7 +1039,10 @@ export class DaemonServer {
                             allowHosts: this.config.proxy.allowHosts ?? [],
                             allowConnectPorts: this.config.proxy.allowConnectPorts,
                             egressBindIp,
+                            busyMbps: this.config.proxy.busyMbps,
+                            whitelist: this.config.proxy.whitelist ?? [],
                             resolvePeerName: (srcIp) => this.ipam.resolveIp(srcIp)?.name,
+                            resolvePeerUserid: (srcIp) => this.ipam.resolveIp(srcIp)?.carrierId,
                             // Per-tunnel audit is opt-in: on a busy exit it floods the
                             // log (the 13 GB audit.log bug). Off by default; ACL and
                             // connect events are still always audited.

package/dist/proxy/connect-proxy.d.ts

@@ -37,6 +37,16 @@ export interface ConnectProxyOptions {
     egressBindIp?: string;
     /** Hook for resolving a source IP to a friendly peer name (audit/log). */
     resolvePeerName?: (sourceIp: string) => string | undefined;
+    /** Hook for resolving a source IP to the peer's Carrier userid. Used to test
+     *  the busy-tier whitelist (which is keyed by userid). */
+    resolvePeerUserid?: (sourceIp: string) => string | undefined;
+    /** Aggregate egress throughput (Mbps) at/above which the exit counts as
+     *  "busy": while busy, only whitelisted peers get NEW tunnels. 0/undefined =
+     *  never busy = free for all (default, current behaviour). */
+    busyMbps?: number;
+    /** Carrier userids (or virtual IPs) always served even when busy — the paid /
+     *  priority set. */
+    whitelist?: string[];
     /** Called when a tunnel opens. */
     onTunnelOpen?: (info: {
         src: string;
@@ -70,6 +80,15 @@ export interface ConnectProxyStats {
     totalOpened: number;
     totalRefused: number;
     bytesTransferred: number;
+    /** Smoothed aggregate egress throughput right now (Mbps). */
+    mbps: number;
+    /** Whether the exit is currently "busy" (mbps >= busyMbps threshold). When
+     *  true, only whitelisted peers get new tunnels. */
+    busy: boolean;
+    /** Configured busy threshold (Mbps); 0 = never busy (free for all). */
+    busyMbps: number;
+    /** Number of userids on the busy-tier whitelist. */
+    whitelistSize: number;
     /** Per-client breakdown, heaviest (by bytes) first. */
     peers: ProxyPeerUsage[];
 }
@@ -80,12 +99,34 @@ export declare class ConnectProxy {
     private stats;
     /** Live per-client usage, keyed by source virtual IP. */
     private perPeer;
+    /** Smoothed aggregate egress throughput (Mbps), refreshed once a second. */
+    private mbps;
+    /** Bytes seen since the last meter tick (reset every second). */
+    private windowBytes;
+    private meterTimer?;
     constructor(opts: ConnectProxyOptions);
+    /** The exit is "busy" when its smoothed egress rate is at/above busyMbps.
+     *  A 0/undefined threshold means it is never busy — free for all (default). */
+    private isBusy;
+    /** A peer is whitelisted (always served, even when busy) if its userid — or,
+     *  as a fallback, its source virtual IP — is on the whitelist. */
+    private isWhitelisted;
     /** Get-or-create the per-client usage row for a source IP. */
     private peerRow;
     start(): Promise<void>;
     stop(): Promise<void>;
     getStats(): ConnectProxyStats;
+    /**
+     * Replace the busy-tier whitelist and/or threshold on a RUNNING proxy without
+     * a restart — handleConnect reads both at CONNECT time, so this takes effect
+     * on the next tunnel. Restarting would drop every Carrier session and trigger
+     * a slow reconvergence storm; live update is what makes `agentnet proxy
+     * whitelist add <userid>` (and a future billing webhook) instant.
+     */
+    updateAdmission(opts: {
+        whitelist?: string[];
+        busyMbps?: number;
+    }): void;
     /**
      * Update the host allowlist (and optionally the port allowlist) of a
      * RUNNING proxy without restarting it. handleConnect reads

package/dist/proxy/connect-proxy.js

@@ -29,6 +29,11 @@ export class ConnectProxy {
     stats;
     /** Live per-client usage, keyed by source virtual IP. */
     perPeer = new Map();
+    /** Smoothed aggregate egress throughput (Mbps), refreshed once a second. */
+    mbps = 0;
+    /** Bytes seen since the last meter tick (reset every second). */
+    windowBytes = 0;
+    meterTimer;
     constructor(opts) {
         this.opts = opts;
         this.logger = new Logger({ prefix: "ConnectProxy" });
@@ -40,9 +45,30 @@ export class ConnectProxy {
             totalOpened: 0,
             totalRefused: 0,
             bytesTransferred: 0,
+            mbps: 0,
+            busy: false,
+            busyMbps: opts.busyMbps ?? 0,
+            whitelistSize: opts.whitelist?.length ?? 0,
             peers: [],
         };
     }
+    /** The exit is "busy" when its smoothed egress rate is at/above busyMbps.
+     *  A 0/undefined threshold means it is never busy — free for all (default). */
+    isBusy() {
+        const limit = this.opts.busyMbps ?? 0;
+        return limit > 0 && this.mbps >= limit;
+    }
+    /** A peer is whitelisted (always served, even when busy) if its userid — or,
+     *  as a fallback, its source virtual IP — is on the whitelist. */
+    isWhitelisted(src) {
+        const wl = this.opts.whitelist;
+        if (!wl || wl.length === 0)
+            return false;
+        if (wl.includes(src))
+            return true; // whitelist-by-IP convenience
+        const uid = this.opts.resolvePeerUserid?.(src);
+        return uid !== undefined && wl.includes(uid);
+    }
     /** Get-or-create the per-client usage row for a source IP. */
     peerRow(src, srcName) {
         let row = this.perPeer.get(src);
@@ -85,11 +111,27 @@ export class ConnectProxy {
             });
         });
         this.stats.startedAt = Date.now();
-        this.logger.info(`Listening on ${this.opts.bindIp}:${this.opts.port}`);
+        // Throughput meter for busy-detection: sum bytes each second → Mbps, then
+        // EWMA-smooth so a bursty video stream (or one idle second between segments)
+        // doesn't flip "busy" on/off and readmit a flood of free users mid-spike.
+        this.meterTimer = setInterval(() => {
+            const inst = (this.windowBytes * 8) / 1e6; // Mbps in the last second
+            this.windowBytes = 0;
+            this.mbps = 0.5 * this.mbps + 0.5 * inst;
+        }, 1000);
+        this.meterTimer.unref?.();
+        this.logger.info(`Listening on ${this.opts.bindIp}:${this.opts.port}` +
+            (this.opts.busyMbps
+                ? ` · free-tier admission: busy>=${this.opts.busyMbps}Mbps → whitelist-only (${this.opts.whitelist?.length ?? 0} userid(s))`
+                : " · free for all (no busy threshold set)"));
     }
     async stop() {
         if (!this.server)
             return;
+        if (this.meterTimer) {
+            clearInterval(this.meterTimer);
+            this.meterTimer = undefined;
+        }
         const srv = this.server;
         this.server = null;
         await new Promise((res) => {
@@ -101,7 +143,29 @@ export class ConnectProxy {
         const peers = [...this.perPeer.values()]
             .sort((a, b) => b.bytesTransferred - a.bytesTransferred || b.totalOpened - a.totalOpened)
             .map((p) => ({ ...p }));
-        return { ...this.stats, peers };
+        return {
+            ...this.stats,
+            mbps: Math.round(this.mbps * 10) / 10,
+            busy: this.isBusy(),
+            busyMbps: this.opts.busyMbps ?? 0,
+            whitelistSize: this.opts.whitelist?.length ?? 0,
+            peers,
+        };
+    }
+    /**
+     * Replace the busy-tier whitelist and/or threshold on a RUNNING proxy without
+     * a restart — handleConnect reads both at CONNECT time, so this takes effect
+     * on the next tunnel. Restarting would drop every Carrier session and trigger
+     * a slow reconvergence storm; live update is what makes `agentnet proxy
+     * whitelist add <userid>` (and a future billing webhook) instant.
+     */
+    updateAdmission(opts) {
+        if (opts.whitelist !== undefined)
+            this.opts.whitelist = opts.whitelist;
+        if (opts.busyMbps !== undefined)
+            this.opts.busyMbps = opts.busyMbps;
+        this.logger.info(`Admission updated live: busy>=${this.opts.busyMbps ?? 0}Mbps, ` +
+            `whitelist=${this.opts.whitelist?.length ?? 0} userid(s)`);
     }
     /**
      * Update the host allowlist (and optionally the port allowlist) of a
@@ -149,6 +213,14 @@ export class ConnectProxy {
             this.refuse(clientSocket, src, srcName, `${host}:${port}`, 403, "host not in allowHosts");
             return;
         }
+        // Free-tier admission control. While the exit is busy (egress at/above the
+        // configured busyMbps), only whitelisted (paid/priority) peers get NEW
+        // tunnels; free users are told to retry. Existing tunnels are never cut, and
+        // an exit with no busyMbps set is never "busy" (free for all — the default).
+        if (this.isBusy() && !this.isWhitelisted(src)) {
+            this.refuse(clientSocket, src, srcName, `${host}:${port}`, 503, `exit busy (${Math.round(this.mbps)}Mbps) — free capacity full; whitelisted/paid peers only. Retry shortly.`);
+            return;
+        }
         let bytes = 0;
         let closed = false;
         let lastBytes = -1;
@@ -199,6 +271,7 @@ export class ConnectProxy {
         });
         const onData = (chunk) => {
             bytes += chunk.length;
+            this.windowBytes += chunk.length; // feed the busy-detection meter
         };
         upstream.on("data", onData);
         clientSocket.on("data", onData);
@@ -246,7 +319,7 @@ export class ConnectProxy {
         row.lastSeenMs = Date.now();
         this.logger.info(`tunnel refused ${src}${srcName ? ` (${srcName})` : ""} -> ${target}: ${reason}`);
         try {
-            const statusText = code === 400 ? "Bad Request" : "Forbidden";
+            const statusText = code === 400 ? "Bad Request" : code === 503 ? "Service Unavailable" : "Forbidden";
             clientSocket.write(`HTTP/1.1 ${code} ${statusText}\r\nProxy-Agent: decentlan\r\nContent-Type: text/plain\r\nConnection: close\r\n\r\n${reason}\n`);
         }
         catch {

package/dist/proxy/multi-exit-router.js

@@ -33,7 +33,15 @@ export const BUILTIN_REGION_DOMAINS = {
     china: [
         ".cn",
         ".cctv.com", ".cctvpic.com", ".cntv.cn", ".cctv.cn",
-        ".v.myalicdn.com", // CCTV live HLS rides Ali CDN video subdomains (piccpndali.v.myalicdn.com etc.)
+        // CCTV live rotates its HLS/FLV across several third-party video CDNs; the
+        // decision API hands back whichever is up, so ALL of them must ride a China
+        // exit or the segment host leaks direct → the CDN geo-blocks ("您所在的地区,
+        // 暂不支持播放该视频"). Ali is .v.myalicdn.com; Kingsoft is .v.kcdnvip.com
+        // (+ its ks-cdn/ksyuncdn CNAME targets); Tencent/Volcano are covered below.
+        // These .com CDNs aren't caught by the .cn rule and the geo-classifier misses
+        // subdomains that resolve to a non-China edge, so pin them statically.
+        ".v.myalicdn.com", ".myalicdn.com",
+        ".kcdnvip.com", ".ks-cdn.com", ".ksyuncdn.com",
         ".bilibili.com", ".biliapi.net", ".bilivideo.com", ".bilivideo.cn", ".hdslb.com",
         ".youku.com", ".iqiyi.com", ".iq.com", ".mgtv.com", ".hitv.com",
         ".miguvideo.com", ".cmvideo.cn", ".migu.cn",
@@ -114,6 +122,7 @@ const STALL_MIN_OPEN_MS = 4000; // only a tunnel open at least this long can cou
 const STALL_MIN_BYTES = 16 * 1024; // delivered at least this = a healthy, real segment
 const STALL_DEAD_BYTES = 1024; // relayed LESS than this = the exit is genuinely dead (only THIS counts as a stall); a small-but-real request (playlist/key/keep-alive, 1-16 KB) is NEUTRAL, so it can't flap a healthy exit out of the pool
 const TRIP_AFTER_STALLS = 3; // consecutive DEAD tunnels before an exit is tripped out (hysteresis)
+const TRIP_AFTER_UPSTREAM_FAILS = 5; // consecutive non-200 CONNECT responses (exit's proxy broken, e.g. 502s everything) before tripping
 const TRIP_COOLDOWN_MS = 30_000; // how long a tripped exit stays excluded before it's retried
 // Measures peak short-window throughput of a byte stream. Feed it every chunk
 // length via add(); read peakBps at the end. Peak (not average) shrugs off TCP
@@ -196,6 +205,7 @@ export function startMultiExitRouter(opts) {
         served: 0,
         lastRtt: null,
         lastSuccessMs: null,
+        consecUpstreamFails: 0,
         speedEwma: null,
         bytesDown: 0,
         stalls: 0,
@@ -458,6 +468,7 @@ export function startMultiExitRouter(opts) {
                 // tunnels are flowing.
                 exit.lastSuccessMs = Date.now();
                 exit.fails = 0;
+                exit.consecUpstreamFails = 0;
                 if (!exit.healthy) {
                     exit.healthy = true;
                     log(`✓ ${exit.name} [${exit.region}] UP (live traffic)`);
@@ -527,7 +538,29 @@ export function startMultiExitRouter(opts) {
                 up.on("error", () => client.destroy());
             }
             else {
-                // Exit answered but the ORIGIN errored (502/403/…) — not an exit fault.
+                // Exit answered with a non-200 CONNECT status. Usually the ORIGIN's
+                // fault (a dead host 502s on EVERY exit — tripping would churn the pool),
+                // so we just fail over. BUT if THIS exit returns non-200 for many targets
+                // in a row (reset on any success), its own proxy is broken — e.g. it 502s
+                // everything (dead upstream / wrong version). Trip it so it stops eating
+                // the first pick on every request.
+                //
+                // Guard with the health probe: only trip an exit that is ALSO failing its
+                // probe (its proxy is genuinely unreachable). A 502 means the exit's proxy
+                // ANSWERED — it's alive — and the ORIGIN failed. When several DEAD origins
+                // are hit in a row (observed on CCTV: js.data.cctv.cn + p.data.cctv.cn,
+                // both unreachable even from inside China, 502 on every exit), the streak
+                // reaches the threshold and would trip a perfectly healthy exit out of the
+                // pool mid-stream (sh got tripped this way). The probe is the real
+                // proxy-liveness signal; a run of origin 502s alone must not evict an exit.
+                exit.consecUpstreamFails++;
+                const proxyAlive = exit.healthy || (exit.lastSuccessMs !== null && Date.now() - exit.lastSuccessMs < RECENT_SUCCESS_MS);
+                if (!proxyAlive && exit.consecUpstreamFails >= TRIP_AFTER_UPSTREAM_FAILS && exit.trippedUntil <= Date.now()) {
+                    exit.trippedUntil = Date.now() + TRIP_COOLDOWN_MS;
+                    exit.healthy = false;
+                    log(`✗ ${exit.name} [${exit.region}] TRIPPED for ${TRIP_COOLDOWN_MS / 1000}s (proxy returned ${status.trim()} for ${exit.consecUpstreamFails} targets in a row) — excluding from pool`);
+                    printPool();
+                }
                 fail(`upstream ${status}`, false);
             }
         };

package/dist/tun/tun-device.js

@@ -8,7 +8,7 @@
  *    4-byte big-endian length-prefix framing.
  */
 import { EventEmitter } from "events";
-import { spawn } from "child_process";
+import { spawn, execFileSync } from "child_process";
 import { resolve, dirname } from "path";
 import { existsSync } from "fs";
 import { fileURLToPath } from "url";
@@ -181,6 +181,24 @@ export class TunDevice extends EventEmitter {
             throw new Error(`TUN helper binary not found: ${helperPath || "(none)"}\n` +
                 `Build it with: cd helper/tun-helper && go build -o bin/tun-helper-linux-amd64 .`);
         }
+        // On Linux the helper creates a FIXED-name interface (agentnet0). If a
+        // prior helper died uncleanly — e.g. "read tun: file descriptor in bad
+        // state" during a rebuild, or a hard kill — the interface lingers, and the
+        // new helper fails to create it (EEXIST) → the daemon loops forever on
+        // "TUN rebuild failed (code=1)" until an operator manually runs
+        // `ip link delete agentnet0`. Pre-delete any stale interface so the
+        // (re)build is idempotent and self-heals. Best-effort: on a clean first
+        // start the interface is absent and this no-ops; macOS uses a dynamic
+        // utun so there is no fixed-name collision and we skip it.
+        if (process.platform === "linux") {
+            try {
+                execFileSync("ip", ["link", "delete", this.config.name], { stdio: "ignore" });
+                this.logger.info(`Removed stale interface ${this.config.name} before (re)build`);
+            }
+            catch {
+                // Interface didn't exist — normal on a clean start; nothing to clean up.
+            }
+        }
         this.logger.info(`Spawning TUN helper: ${helperPath}`);
         this.helper = spawn(helperPath, ["--name", this.config.name], {
             stdio: ["pipe", "pipe", "pipe"],

package/dist/types.d.ts

@@ -110,6 +110,10 @@ export interface BootstrapNode {
     port: number;
     pk: string;
     isTcp?: boolean;
+    /** Express relays only: set `false` to reach the relay over plain HTTP
+     *  instead of HTTPS (the payload is already end-to-end encrypted). Lets a
+     *  relay run on a raw IP with no TLS cert / domain / ICP filing. */
+    tls?: boolean;
 }
 export interface CarrierConfig {
     dataDir: string;
@@ -135,6 +139,8 @@ export interface ProxyConfig {
     allowConnectPorts?: number[];
     auditTunnels?: boolean;
     egress?: string;
+    busyMbps?: number;
+    whitelist?: string[];
 }
 export interface FriendsConfig {
     /** When true (default), the running daemon auto-accepts incoming

package/dist/ui/desktop/app.js

@@ -173,15 +173,24 @@ async function dkGet(path) {
   return r.json();
 }
 async function dkPost(path, body) {
-  const r = await fetch(path, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(body || {})
-  });
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 15e3);
   try {
-    return await r.json();
+    const r = await fetch(path, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body || {}),
+      signal: ctrl.signal
+    });
+    try {
+      return await r.json();
+    } catch (e) {
+      return { ok: r.ok };
+    }
   } catch (e) {
-    return { ok: r.ok };
+    return { ok: false, error: e && e.name === "AbortError" ? "timed out" : e && e.message || "network error" };
+  } finally {
+    clearTimeout(timer);
   }
 }
 function dkCopy(text) {
@@ -1012,6 +1021,9 @@ function PeerSidebar({ T, peers, requests, activeId, onSelect, onAct, onAdd }) {
       } else {
         setAddState({ kind: "err", msg: r && r.error ? `${T.addFailed}: ${r.error}` : T.addFailed });
       }
+    }).catch((e) => {
+      setAddState({ kind: "err", msg: `${T.addFailed}: ${e && e.message || e}` });
+    }).finally(() => {
       setTimeout(() => setAddState((s) => s && s.kind !== "sending" ? null : s), 6e3);
     });
   };

package/dist/ui/server.js

@@ -665,8 +665,27 @@ export function startFriendUi(opts) {
             }
             if (req.method === "POST" && url === "/api/add") {
                 const { address } = await readBody(req);
-                const r = await opts.call({ op: "friend-request", address });
-                sendJson(res, r.ok ? 200 : 400, r);
+                // A friend-request is fire-and-forget: it's delivered when the peer is
+                // online and only becomes a friend once they accept. Don't let the UI
+                // hang on the network round-trip (DHT lookup / unreachable peer) — kick
+                // the send off, but respond within a short window. A fast failure (e.g.
+                // a malformed address) still surfaces its real error; a slow send
+                // returns optimistic success and continues in the background.
+                const sent = opts
+                    .call({ op: "friend-request", address })
+                    .then((r) => ({ done: true, r }))
+                    .catch((e) => ({ done: true, r: { ok: false, error: e instanceof Error ? e.message : String(e) } }));
+                const settled = await Promise.race([
+                    sent,
+                    new Promise((r) => setTimeout(() => r({ done: false }), 2500)),
+                ]);
+                if (settled.done) {
+                    sendJson(res, settled.r.ok ? 200 : 400, settled.r);
+                }
+                else {
+                    void sent.catch(() => { }); // let it finish in the background, no unhandled rejection
+                    sendJson(res, 200, { ok: true, queued: true });
+                }
                 return;
             }
             res.writeHead(404);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.151",
+  "version": "0.1.155",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -78,7 +78,7 @@
     "build:console": "node scripts/build-console.mjs"
   },
   "dependencies": {
-    "@decentnetwork/dora": "^0.1.11",
+    "@decentnetwork/dora": "^0.1.13",
     "@decentnetwork/peer": "^0.1.79",
     "ink": "^5.2.1",
     "js-yaml": "^4.1.0",