@decentnetwork/lan 0.1.184 → 0.1.187

package/dist/cli/commands.d.ts

@@ -341,6 +341,17 @@ export declare function cmdUi(args: {
     doraDir?: string;
     configDir?: string;
 }): Promise<void>;
+/**
+ * `agentnet proxy trust-ca` — one command for a new user to generate the
+ * HLS-accel MITM CA (if it doesn't exist yet) and install it as a trusted
+ * root, so `agentnet proxy router --hls-accel` works without cert errors.
+ * The CA is generated LOCALLY per machine (never shared), lives in
+ * ~/.agentnet/mitm-ca-cert.pem, and only ever signs certs for the China
+ * video-CDN hosts the router MITMs.
+ */
+export declare function cmdProxyTrustCa(args: {
+    configDir?: string;
+}): Promise<void>;
 export declare function cmdProxyRouter(args: {
     exit?: string[];
     port?: number;

package/dist/cli/commands.js

@@ -1392,6 +1392,46 @@ export async function cmdUi(args) {
     // Keep the process alive; runs until Ctrl-C / signal.
     await new Promise(() => { });
 }
+/**
+ * `agentnet proxy trust-ca` — one command for a new user to generate the
+ * HLS-accel MITM CA (if it doesn't exist yet) and install it as a trusted
+ * root, so `agentnet proxy router --hls-accel` works without cert errors.
+ * The CA is generated LOCALLY per machine (never shared), lives in
+ * ~/.agentnet/mitm-ca-cert.pem, and only ever signs certs for the China
+ * video-CDN hosts the router MITMs.
+ */
+export async function cmdProxyTrustCa(args) {
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    const { loadOrCreateCa } = await import("../proxy/mitm-ca.js");
+    const { caCertPath, created } = loadOrCreateCa(dir);
+    console.log(created ? `Generated new MITM CA: ${caCertPath}` : `MITM CA already exists: ${caCertPath}`);
+    const { spawnSync } = await import("child_process");
+    if (process.platform === "darwin") {
+        console.log("Installing into the System keychain (asks for your admin password)...");
+        const r = spawnSync("sudo", ["security", "add-trusted-cert", "-d", "-r", "trustRoot", "-k", "/Library/Keychains/System.keychain", caCertPath], { stdio: "inherit" });
+        if (r.status === 0) {
+            console.log("✓ Trusted. Chrome/Safari pick it up immediately (reload the page).");
+        }
+        else {
+            console.log("Install failed — run manually:");
+            console.log(`  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${caCertPath}"`);
+        }
+        return;
+    }
+    if (process.platform === "linux") {
+        console.log("Installing into the system CA store (asks for your sudo password)...");
+        const cp = spawnSync("sudo", ["cp", caCertPath, "/usr/local/share/ca-certificates/agentnet-mitm-ca.crt"], { stdio: "inherit" });
+        const up = cp.status === 0 ? spawnSync("sudo", ["update-ca-certificates"], { stdio: "inherit" }) : cp;
+        if (up.status === 0)
+            console.log("✓ System store updated.");
+        console.log("NOTE: Chrome/Chromium on Linux use their OWN store (NSS). Also run:");
+        console.log(`  certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n agentnet-mitm-ca -i "${caCertPath}"`);
+        console.log("(package: libnss3-tools). Firefox: Settings → Certificates → Import.");
+        return;
+    }
+    console.log("Windows: import the cert into 'Trusted Root Certification Authorities':");
+    console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+}
 export async function cmdProxyRouter(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();
     const config = await ConfigLoader.load(resolve(dir, "config.yaml"));

package/dist/cli/index.js

@@ -10,7 +10,7 @@ import { hideBin } from "yargs/helpers";
 // Belt-and-braces — also raise it here in case the CLI is run directly
 // (e.g. `node dist/cli/index.js` rather than via dist/index.js).
 EventEmitter.defaultMaxListeners = 100;
-import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
+import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
 async function main() {
     await yargs(hideBin(process.argv))
         .scriptName("agentnet")
@@ -350,6 +350,9 @@ async function main() {
         .option("peer", { type: "string", demandOption: true, describe: "Peer name or carrier ID" })
         .option("config-dir", { type: "string" }), async (argv) => {
         await cmdProxyUse({ peer: argv.peer, configDir: argv["config-dir"] });
+    })
+        .command("trust-ca", "Generate (if needed) and trust the HLS-accel MITM CA so --hls-accel works without cert errors", (yy) => yy.option("config-dir", { type: "string" }), async (argv) => {
+        await cmdProxyTrustCa({ configDir: argv["config-dir"] });
     })
         .command("router", "Run a local multi-exit HTTPS proxy: load-balance/failover across exits, China-split tunnel", (yy) => yy
         .option("exit", {

package/dist/proxy/hls-prefetch.d.ts

@@ -4,8 +4,9 @@ export interface FetchedResponse {
     body: Buffer;
 }
 /** Fetch one absolute http:// URL through some exit; provided by the router.
- *  `label` lets the router log the fetch (e.g. "prefetch"). */
-export type UrlFetcher = (url: URL, headers: Record<string, string>, label?: string) => Promise<FetchedResponse>;
+ *  `label` lets the router log the fetch (e.g. "prefetch"). `signal` lets a
+ *  hedged stripe abort a slow fetch and retry on another exit. */
+export type UrlFetcher = (url: URL, headers: Record<string, string>, label?: string, signal?: AbortSignal, exitHint?: number) => Promise<FetchedResponse>;
 export declare function looksLikePlaylist(pathname: string): boolean;
 export declare function looksLikeSegment(pathname: string): boolean;
 export interface HlsVariant {
@@ -39,19 +40,37 @@ export interface HlsPrefetcherOptions {
     prefetchAhead?: number;
     /** Max concurrent prefetch downloads (default 4). */
     concurrency?: number;
+    /** Dynamic concurrency: how many DISTINCT exits are actually delivering right
+     *  now. Each concurrent prefetch is a whole-segment fetch that lands on its
+     *  own exit (the router's load-aware pick spreads them), so parallelism above
+     *  the working-exit count just splits one exit's bandwidth between segments —
+     *  while parallelism below it leaves working exits idle. Overrides
+     *  `concurrency` when provided. */
+    concurrencyFn?: () => number;
     /** Skip caching bodies larger than this (default 32 MB). */
     maxEntryBytes?: number;
     /** Split each segment into this many parallel byte-range stripes across the
-     *  exit pool (default 6). 1 disables striping. Lets ONE segment ride the SUM
+     *  exit pool (default 4). 1 disables striping. Lets ONE segment ride the SUM
      *  of the exits' bandwidth instead of a single throttled connection. */
     stripes?: number;
-    /** Stripe chunk size — also the first probe chunk (default 192 KB). Segments
+    /** Dynamic stripe count: returns how many exits are ACTUALLY delivering right
+     *  now, so a segment is split only as many ways as there are working exits.
+     *  With one working exit it returns 1 (whole fetch — striping onto a single
+     *  exit just serializes and stalls); as exits recover it rises and aggregation
+     *  resumes. Overrides `stripes` when provided. */
+    stripesFn?: () => number;
+    /** Stripe chunk size — also the first probe chunk (default 256 KB). Segments
      *  smaller than this aren't striped. */
     stripeChunkBytes?: number;
 }
 export declare class HlsPrefetcher {
     #private;
     constructor(fetcher: UrlFetcher, opts?: HlsPrefetcherOptions);
+    /** Fetch a segment as PARALLEL byte-range stripes across the exit pool, so one
+     *  segment downloads at the SUM of the exits' bandwidth (beating the GFW
+     *  per-connection throttle). Public entry for a cold on-demand segment miss;
+     *  the result is what the router serves to the browser. */
+    fetchSegmentStriped(url: string, extraHeaders?: Record<string, string>): Promise<FetchedResponse>;
     get stats(): {
         hits: number;
         misses: number;

package/dist/proxy/hls-prefetch.js

@@ -17,11 +17,24 @@
 // master playlist (#EXT-X-STREAM-INF) lists variants, not segments.
 //
 const SEGMENT_EXTS = [".ts", ".m4s", ".m4a", ".m4v", ".aac", ".mp3", ".mp4", ".vtt"];
-/** Parse the total size out of a `Content-Range: bytes 0-N/TOTAL` header. */
-function contentRangeTotal(cr) {
-    const s = Array.isArray(cr) ? cr[0] : cr;
-    const m = s ? /\/(\d+)\s*$/.exec(s) : null;
-    return m ? Number(m[1]) : 0;
+/** Per-stripe deadline: if a byte-range hasn't landed in this long, abort it and
+ *  retry the SAME range on another exit — so one dead/throttled exit (0.1 Mbps)
+ *  can't hang a whole segment for 30–54s. */
+const STRIPE_DEADLINE_MS = 6000;
+/** How many exits to try for one stripe before giving up on it. */
+const STRIPE_TRIES = 3;
+/** Whole-segment hedge delay: a live segment is ~4s of video; one that hasn't
+ *  landed in this long is late (a healthy exit delivers in 1-3.5s), so a
+ *  parallel duplicate on another exit is launched. Rarely fires in steady
+ *  state; mainly absorbs redemption probes trapped by a still-bad exit. */
+const WHOLE_HEDGE_MS = 5000;
+/** Total size from a `Content-Range: bytes 0-255/900000` header, or null. */
+function contentRangeTotal(h) {
+    const v = Array.isArray(h) ? h[0] : h;
+    if (!v)
+        return null;
+    const m = /\/\s*(\d+)\s*$/.exec(v.trim());
+    return m ? Number(m[1]) : null;
 }
 export function looksLikePlaylist(pathname) {
     const p = pathname.toLowerCase();
@@ -96,8 +109,10 @@ export class HlsPrefetcher {
     #ttlMs;
     #ahead;
     #concurrency;
+    #concurrencyFn;
     #maxEntryBytes;
     #stripes;
+    #stripesFn;
     #stripeChunkBytes;
     #hits = 0;
     #misses = 0;
@@ -107,55 +122,175 @@ export class HlsPrefetcher {
         this.#ttlMs = opts.ttlMs ?? 120_000;
         this.#ahead = opts.prefetchAhead ?? 4;
         this.#concurrency = opts.concurrency ?? 4;
+        this.#concurrencyFn = opts.concurrencyFn;
         this.#maxEntryBytes = opts.maxEntryBytes ?? 32 * 1024 * 1024;
-        this.#stripes = Math.max(1, opts.stripes ?? 6);
-        this.#stripeChunkBytes = opts.stripeChunkBytes ?? 192 * 1024;
-    }
-    /** Fetch `u` as PARALLEL byte-range stripes. Each range is a separate
-     *  `#fetcher` call, which the router load-balances onto a DIFFERENT exit — so
-     *  one segment downloads at the SUM of the pool's bandwidth, beating the GFW
-     *  per-connection throttle (the reason a single stream stalls even with many
-     *  exits). Falls back to one whole-body fetch if the origin ignores Range or
-     *  any stripe fails (correctness over speed). */
-    async #stripeFetch(u) {
-        const whole = () => this.#fetcher(u, { host: u.host }, "prefetch");
-        if (this.#stripes <= 1)
-            return whole();
-        const guess = this.#stripeChunkBytes;
-        let first;
-        try {
-            first = await this.#fetcher(u, { host: u.host, range: `bytes=0-${guess - 1}` }, "stripe");
+        this.#stripes = Math.max(1, opts.stripes ?? 4);
+        this.#stripesFn = opts.stripesFn;
+        this.#stripeChunkBytes = opts.stripeChunkBytes ?? 256 * 1024;
+    }
+    /** Effective stripe count right now (dynamic if a stripesFn was provided). */
+    #stripeCount() {
+        const n = this.#stripesFn ? this.#stripesFn() : this.#stripes;
+        return Math.max(1, Math.floor(n));
+    }
+    /** Fetch a segment as PARALLEL byte-range stripes across the exit pool, so one
+     *  segment downloads at the SUM of the exits' bandwidth (beating the GFW
+     *  per-connection throttle). Public entry for a cold on-demand segment miss;
+     *  the result is what the router serves to the browser. */
+    async fetchSegmentStriped(url, extraHeaders = {}) {
+        const cached = this.#peek(url);
+        if (cached)
+            return { status: 200, headers: { "content-type": cached.contentType ?? "application/octet-stream" }, body: cached.body };
+        // If a prefetch for this exact segment is already in flight, JOIN it instead
+        // of starting a second download — dedups the player's request against the
+        // prefetcher so the pool's bandwidth isn't split fetching the same bytes twice.
+        const inflight = this.#inflight.get(url);
+        if (inflight) {
+            const e = await inflight;
+            if (e)
+                return { status: 200, headers: { "content-type": e.contentType ?? "application/octet-stream" }, body: e.body };
         }
-        catch {
-            return whole();
+        // Start a TRACKED fetch so a concurrent prefetch+player collapse onto one.
+        const p = (async () => {
+            try {
+                const res = await this.#stripeFetch(new URL(url), extraHeaders);
+                if (res.status === 200 && res.body.length > 0 && res.body.length <= this.#maxEntryBytes) {
+                    const ct = res.headers["content-type"];
+                    const entry = { body: res.body, contentType: Array.isArray(ct) ? ct[0] : ct, at: Date.now() };
+                    this.#insert(url, entry);
+                    return entry;
+                }
+                return null;
+            }
+            catch {
+                return null;
+            }
+            finally {
+                this.#inflight.delete(url);
+            }
+        })();
+        this.#inflight.set(url, p);
+        const e = await p;
+        if (e)
+            return { status: 200, headers: { "content-type": e.contentType ?? "application/octet-stream" }, body: e.body };
+        return this.#stripeFetch(new URL(url), extraHeaders); // fetch failed → one direct attempt for a real status
+    }
+    /** One whole-body fetch through a single exit — the correctness fallback when
+     *  the origin ignores Range or a stripe can't be completed. No deadline: if
+     *  every exit is slow, a slow whole body still beats a corrupt/empty one.
+     *
+     *  HEDGED when ≥2 exits are delivering: if the body hasn't landed within
+     *  WHOLE_HEDGE_MS, launch a PARALLEL duplicate (the router's load-aware pick
+     *  sends it to the best other exit) and take whichever finishes first. This
+     *  absorbs the redemption probe: a just-redeemed exit that traps its probe
+     *  segment for 13-15s used to stall playback every REDEMPTION cycle — now
+     *  the hedge covers the segment while the probe runs to its deadline and
+     *  floors the bad exit properly (the loser is NOT aborted, on purpose: an
+     *  aborted probe never gets floored and would be re-probed forever). */
+    #whole(u, extra) {
+        const one = () => this.#fetcher(u, { ...extra, host: u.host }, "prefetch");
+        const canHedge = (this.#concurrencyFn ? this.#concurrencyFn() : this.#concurrency) >= 2;
+        if (!canHedge)
+            return one(); // single exit: a duplicate would just split its bandwidth
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            let fails = 0;
+            let hedged = false;
+            let timer = null;
+            const win = (r) => { if (settled)
+                return; settled = true; if (timer)
+                clearTimeout(timer); resolve(r); };
+            const lose = (e) => { fails++; if (!settled && fails >= (hedged ? 2 : 1)) {
+                settled = true;
+                if (timer)
+                    clearTimeout(timer);
+                reject(e);
+            } };
+            one().then(win, lose);
+            timer = setTimeout(() => {
+                timer = null;
+                if (settled)
+                    return;
+                hedged = true;
+                this.#fetcher(u, { ...extra, host: u.host }, "prefetch-hedge").then(win, lose);
+            }, WHOLE_HEDGE_MS);
+            timer.unref?.();
+        });
+    }
+    /** Fetch one byte-range, HEDGED: on timeout/error/wrong-length, abort and retry
+     *  the SAME range (the router rotates to a different exit each call), up to
+     *  STRIPE_TRIES exits. Returns null only if every try failed. `exactLen`, when
+     *  given, rejects a 206 whose body isn't exactly that long (so assembly is
+     *  byte-correct); the probe passes it undefined to accept whatever 206 arrives. */
+    async #fetchRange(u, start, end, extra, exactLen, exitHint) {
+        for (let t = 0; t < STRIPE_TRIES; t++) {
+            const ac = new AbortController();
+            const timer = setTimeout(() => ac.abort(), STRIPE_DEADLINE_MS);
+            timer.unref?.();
+            try {
+                // Each retry shifts to the NEXT exit so a failed range moves off a bad one.
+                const hint = exitHint === undefined ? undefined : exitHint + t;
+                const r = await this.#fetcher(u, { ...extra, host: u.host, range: `bytes=${start}-${end}` }, "stripe", ac.signal, hint);
+                clearTimeout(timer);
+                if (r.status === 200)
+                    return r; // origin ignored Range → whole body
+                if (r.status === 206 && (exactLen === undefined || r.body.length === exactLen))
+                    return r;
+                // wrong status/length → try another exit
+            }
+            catch {
+                clearTimeout(timer);
+            }
         }
-        if (first.status === 200)
-            return first; // origin ignored Range → whole body already
-        if (first.status !== 206)
-            return whole();
-        const total = contentRangeTotal(first.headers["content-range"]);
-        const outHeaders = { ...first.headers };
-        delete outHeaders["content-range"];
-        if (!total || total <= first.body.length)
-            return { status: 200, headers: outHeaders, body: first.body };
-        const remaining = total - first.body.length;
-        const n = Math.max(1, Math.min(this.#stripes - 1, Math.ceil(remaining / guess)));
-        const chunk = Math.ceil(remaining / n);
+        return null;
+    }
+    /** Split a segment into `stripes` parallel byte-ranges across the exit pool,
+     *  each hedged. Assembles them into the full body with a corrected
+     *  content-length. Falls back to one whole fetch if the origin ignores Range or
+     *  any stripe truly can't be fetched (correctness over speed). */
+    async #stripeFetch(u, extra) {
+        const stripeCount = this.#stripeCount();
+        // Only ONE exit is delivering right now → striping would split the segment
+        // onto a single exit that serializes the parts (14s vs a 2.4s whole fetch).
+        // Just fetch the whole segment; aggregation resumes when a 2nd exit recovers.
+        if (stripeCount <= 1)
+            return this.#whole(u, extra);
+        // Tiny probe (2 bytes): learn the total size + confirm the origin honors
+        // Range, cheaply — a big sequential probe would add a whole round-trip of
+        // latency before any stripe starts and starve the live buffer.
+        const probe = await this.#fetchRange(u, 0, 1, extra);
+        if (!probe)
+            return this.#whole(u, extra);
+        if (probe.status === 200)
+            return probe; // range ignored → whole body already here
+        if (probe.status !== 206)
+            return this.#whole(u, extra);
+        const total = contentRangeTotal(probe.headers["content-range"]);
+        if (!total || total <= 0)
+            return this.#whole(u, extra);
+        const headers = { ...probe.headers };
+        delete headers["content-range"];
+        // Split the WHOLE body into N equal stripes, fetched IN PARALLEL across the
+        // exit pool — so the segment rides the sum of the exits' bandwidth. Each
+        // stripe is hedged (timeout → retry on another exit), so a dead exit never
+        // stalls it.
+        const n = Math.max(1, Math.min(stripeCount, Math.ceil(total / this.#stripeChunkBytes)));
+        const chunk = Math.ceil(total / n);
         const parts = await Promise.all(Array.from({ length: n }, (_, i) => {
-            const start = first.body.length + i * chunk;
+            const start = i * chunk;
             const end = Math.min(start + chunk - 1, total - 1);
             if (start > end)
                 return Promise.resolve(Buffer.alloc(0));
-            return this.#fetcher(u, { host: u.host, range: `bytes=${start}-${end}` }, "stripe")
-                .then((r) => ((r.status === 206 || r.status === 200) && r.body.length === end - start + 1 ? r.body : null))
-                .catch(() => null);
+            const want = end - start + 1;
+            return this.#fetchRange(u, start, end, extra, want, i).then((r) => (r && r.body.length === want ? r.body : null));
         }));
         if (parts.some((p) => p === null))
-            return whole(); // a stripe failed → refetch whole for integrity
-        const body = Buffer.concat([first.body, ...parts]);
+            return this.#whole(u, extra); // a stripe couldn't be fetched → whole for integrity
+        const body = Buffer.concat(parts);
         if (body.length !== total)
-            return whole();
-        return { status: 200, headers: outHeaders, body };
+            return this.#whole(u, extra);
+        headers["content-length"] = String(body.length);
+        return { status: 200, headers, body };
     }
     get stats() {
         return { hits: this.#hits, misses: this.#misses, entries: this.#cache.size, bytes: this.#cacheBytes };
@@ -203,9 +338,10 @@ export class HlsPrefetcher {
         // list from wherever it is, and refetches of the playlist don't happen —
         // prefetching the head of the list still fills the startup buffer. Either
         // way: take the last `ahead` entries we don't already hold.
+        const conc = Math.max(1, Math.floor(this.#concurrencyFn ? this.#concurrencyFn() : this.#concurrency));
         const want = segs.slice(-this.#ahead).filter((u) => !this.#peek(u) && !this.#inflight.has(u));
         for (const u of want) {
-            if (this.#inflight.size >= this.#concurrency)
+            if (this.#inflight.size >= conc)
                 break;
             this.#prefetch(u);
         }
@@ -214,7 +350,7 @@ export class HlsPrefetcher {
         const p = (async () => {
             try {
                 const u = new URL(url);
-                const res = await this.#stripeFetch(u);
+                const res = await this.#stripeFetch(u, {});
                 if (res.status !== 200 || res.body.length === 0 || res.body.length > this.#maxEntryBytes)
                     return null;
                 const ct = res.headers["content-type"];

package/dist/proxy/multi-exit-router.js

@@ -131,16 +131,40 @@ const STALL_MIN_BYTES = 16 * 1024; // delivered at least this = a healthy, real
 const STALL_DEAD_BYTES = 1024; // relayed LESS than this = the exit is genuinely dead (only THIS counts as a stall); a small-but-real request (playlist/key/keep-alive, 1-16 KB) is NEUTRAL, so it can't flap a healthy exit out of the pool
 const TRIP_AFTER_STALLS = 3; // consecutive DEAD tunnels before an exit is tripped out (hysteresis)
 const TRIP_AFTER_UPSTREAM_FAILS = 5; // consecutive non-200 CONNECT responses (exit's proxy broken, e.g. 502s everything) before tripping
-// Keep a proven exit in rotation only if its measured speed is at least this
-// fraction of the region's FASTEST proven exit. Below it (e.g. a 0.4 Mbps node
-// next to a 1.2 Mbps one) it's benched while a healthy exit exists, so heavy
-// streams don't stall on it. Unproven (unmeasured) exits are never benched.
-const SLOW_EXIT_FLOOR_FRACTION = 0.4;
+const TRIP_COOLDOWN_MS = 30_000; // how long a tripped exit stays excluded before it's retried
 // Hosts that must NEVER be learned into an exit region — global services
 // reachable direct from anywhere; routing them through a china exit only 502s
 // and starves it. Guards against the recurring google→china mislearning.
 const NEVER_LEARN = /(^|\.)(google|gstatic|googleapis|googleusercontent|ggpht|gvt1|gvt2|youtube|ytimg|doubleclick|google-analytics|googletagmanager|firebase|crashlytics|facebook|fbcdn|instagram|twitter|twimg|cloudflare|cloudfront|akamai|akamaihd|amazonaws|apple|icloud|mzstatic|microsoft|windows|office|live|azureedge|github|githubusercontent|gitlab|cdn\.jsdelivr|unpkg|npmjs)\.(com|net|org|io|co|edu|dev|app)$/i;
-const TRIP_COOLDOWN_MS = 30_000; // how long a tripped exit stays excluded before it's retried
+// A prefetch/stripe exit whose measured speed is below this is "near-dead" and
+// skipped while a healthier exit exists, so a single throttled exit (0.1 Mbps
+// 1.16) can't be handed a segment/stripe and stall the player for 30–54s.
+// Unproven (never-measured) exits are NOT skipped — they get a chance, and the
+// per-stripe hedge covers them if they turn out dead.
+// UNITS: speedEwma is BYTES/sec (fmtMbps multiplies by 8 for display), so this
+// threshold is bytes/sec too. It was 250_000 with a "0.25 Mbps" comment — i.e.
+// bits/sec — which silently meant "under 2 Mbit/s = near-dead": real working
+// exits (1.6 Mbit/s = 200 KB/s) got filtered OUT of the fast pool and the one
+// truly-broken unproven exit was left ALONE in the segment order. 60 KB/s
+// (≈0.5 Mbit/s) keeps every usable exit in and sits safely ABOVE the 40 KB/s
+// deprioritize floor so a floored exit still drops out.
+const NEAR_DEAD_EXIT_BPS = 60_000;
+// A buffered segment fetch is given a deadline sized to deliver its body at
+// roughly this bitrate; an exit that can't keep up is abandoned and the next is
+// tried. Live HLS needs each ~4s segment in a few seconds, so this is set near
+// a mid-quality stream's rate — a slow exit is dropped in seconds (not the 27s a
+// 0.35 Mbps floor allowed), and the player's ABR settles on a variant the pool
+// can actually sustain instead of stalling on a too-high one.
+const MIN_USEFUL_FETCH_BPS = 400_000; // 0.4 Mbps — abandon a trickle, but NOT a healthy-slow 0.6 Mbps exit
+const FETCH_DEADLINE_MIN_MS = 5_000;
+const FETCH_DEADLINE_MAX_MS = 13_000;
+// On a lossy link a whole pass over the exits can fail by bad luck; loop the
+// order this many rounds (with fast-failing attempts, most retries are cheap)
+// before giving up, so the player almost never sees a hard failure.
+const MAX_FETCH_ROUNDS = 4;
+// Absolute cap on a cold segment fetch across ALL failover attempts — past this
+// we give up and let the player re-request, never hanging the tab.
+const SEGMENT_TOTAL_DEADLINE_MS = 25_000;
 // Measures peak short-window throughput of a byte stream. Feed it every chunk
 // length via add(); read peakBps at the end. Peak (not average) shrugs off TCP
 // slow-start on high-RTT paths, where a transfer spends its first seconds
@@ -177,6 +201,15 @@ class RateMeter {
         return totalDurMs > 0 ? (this.total / totalDurMs) * 1000 : 0;
     }
 }
+/** Deprioritize an exit that trapped a fetch until the deadline or returned an
+ *  empty 2xx: pin its speed score to the floor so pickOrder stops handing it
+ *  segments — but KEEP it in the pool (last-resort failover, small requests). */
+const FLOOR_BPS = 40_000;
+const REDEMPTION_MS = 90_000;
+function floorExit(exit) {
+    exit.speedEwma = exit.speedEwma === null ? FLOOR_BPS : Math.min(exit.speedEwma, FLOOR_BPS);
+    exit.flooredAtMs = Date.now();
+}
 /** Feed one tunnel's rate meter into the exit's speed EWMA (peak-window based).
  *  Only transfers past SPEED_MIN_BYTES count — smaller ones never reveal path
  *  capacity on a high-RTT link. */
@@ -188,6 +221,7 @@ function sampleSpeed(exit, meter, durMs) {
     if (bps <= 0)
         return;
     exit.speedEwma = exit.speedEwma === null ? bps : SPEED_EWMA_KEEP * exit.speedEwma + (1 - SPEED_EWMA_KEEP) * bps;
+    exit.flooredAtMs = null; // a real qualifying transfer is proof of recovery
 }
 function fmtMbps(bps) {
     return bps === null ? "?" : `${((bps * 8) / 1e6).toFixed(1)}Mbps`;
@@ -223,10 +257,13 @@ export function startMultiExitRouter(opts) {
         lastRtt: null,
         lastSuccessMs: null,
         consecUpstreamFails: 0,
+        emptyStreak: 0,
+        blackholeUntil: 0,
         speedEwma: null,
         bytesDown: 0,
         stalls: 0,
         trippedUntil: 0,
+        flooredAtMs: null,
     }));
     // Per-host routing decision, logged once on first sight so the user can SEE
     // why a hostname went DIRECT vs through a region (e.g. a CCTV video CDN that
@@ -281,6 +318,16 @@ export function startMultiExitRouter(opts) {
         // preconnect fix in suspiciousClose.
         if (NEVER_LEARN.test(host))
             return;
+        // Only learn a host into the china exit if GeoIP CONFIRMS it resolves to a
+        // China IP. A US-geo-blocked GLOBAL host (okx, okex, metamask, phantom,
+        // linkedin) ALSO fails DIRECT — but routing it through a china exit is wrong
+        // (china can't reach it either) and pollutes the pool. This gates ALL global
+        // hosts generically, no per-domain denylist needed. Kick off classification
+        // so the verdict is ready on a later failure (learning needs 2 strikes).
+        if (geoCn.peek(host) !== true) {
+            void geoCn.classify(host);
+            return;
+        }
         if (learner.recordDirectBad(host))
             learner.learn(host, fallbackRegion);
     }
@@ -289,6 +336,25 @@ export function startMultiExitRouter(opts) {
     // region. Catches China-CDN hostnames no suffix list anticipates (Baidu
     // bdydns, etc.). Returns the region to use (may be "direct").
     const geoCn = new GeoCnClassifier();
+    // Startup self-heal: re-validate every learned route against GeoIP and unlearn
+    // any that does NOT resolve to a China IP. This generically purges global hosts
+    // that older builds mislearned into the china exit (okx/okex/metamask/phantom/
+    // linkedin — geo-blocked from the US, so DIRECT failed and they got promoted),
+    // without a hand-maintained denylist. Best-effort + async (one DNS per host).
+    void (async () => {
+        let purged = 0;
+        for (const { host } of learner.entries()) {
+            try {
+                if (!(await geoCn.classify(host))) {
+                    learner.unlearn(host);
+                    purged++;
+                }
+            }
+            catch { /* skip unresolvable */ }
+        }
+        if (purged > 0)
+            log(`geo-purged ${purged} learned route(s) that don't resolve to a China IP (global hosts mislearned into an exit)`);
+    })();
     async function resolveRegion(host) {
         let region = routeFor(host); // static domains + persistent learned routes
         // Consult the geo classifier even when the fallback region currently has
@@ -459,24 +525,6 @@ export function startMultiExitRouter(opts) {
         // Unproven exits still get overflow traffic once the proven ones fill up,
         // which measures them safely without risking the video.
         const unprovenBps = measuredVals.length > 0 ? measuredVals[0] : 800_000;
-        // Speed FLOOR: exclude exits that are dramatically slower than the best
-        // PROVEN exit. `score = speed/(active+1)` self-balances, but once the fast
-        // exit fills, a bandwidth-heavy stream (CCTV opens dozens of parallel
-        // segment tunnels) spills onto a degraded node (observed 0.4 Mbps vs 1.2
-        // Mbps) and stalls/rebuffers. Keep such nodes OUT of rotation while a
-        // healthy-speed exit exists; unproven exits (null speed) stay in so they
-        // still get measured, and we never empty the pool.
-        // Skip the floor when hls-accel is on: parallel-prefetch AGGREGATION wants
-        // every exit contributing bandwidth (even a slow 0.4 Mbps one adds to the
-        // sum), so benching slow exits would REDUCE aggregate throughput — the
-        // opposite of what a bandwidth-heavy HD stream needs.
-        if (!opts.hlsAccel && measuredVals.length >= 2) {
-            const best = measuredVals[measuredVals.length - 1];
-            const floor = best * SLOW_EXIT_FLOOR_FRACTION;
-            const fast = pool.filter((e) => e.speedEwma === null || e.speedEwma >= floor);
-            if (fast.length > 0)
-                pool = fast;
-        }
         const score = (e) => (e.speedEwma ?? unprovenBps) / (e.active + 1);
         return [...pool].sort((a, b) => score(b) - score(a) || a.served - b.served);
     }
@@ -925,13 +973,97 @@ export function startMultiExitRouter(opts) {
         tun.on("data", onHdr);
         tun.on("error", () => { tun.removeListener("data", onHdr); httpForwardViaExit(order, idx + 1, target, host, port, path, req, res, headers, isTls); });
     }
+    // ---- Keep-alive connection pool, one Agent per (exit, protocol) ------------
+    // Every buffered fetch used to build a FRESH path: TCP to the exit (1 RTT) +
+    // CONNECT (1 RTT) + TLS to the origin (1-2 RTT). Over a 280ms/lossy tunnel
+    // that's a ~2s handshake tax on EVERY playlist/segment/stripe — often more
+    // than the transfer itself (a 407-byte playlist measured 2.5s). A keep-alive
+    // Agent per exit reuses the tunneled (TLS) socket across requests to the same
+    // origin, so a hot stream pays the handshake once per (exit, origin).
+    const exitAgents = new Map();
+    function agentFor(exit, isTls) {
+        const key = `${exit.name}|${isTls ? "https" : "http"}`;
+        const hit = exitAgents.get(key);
+        if (hit)
+            return hit;
+        const mkConn = (options, cb) => {
+            const oHost = options.host ?? "";
+            const oPort = Number(options.port) || (isTls ? 443 : 80);
+            const target = `${oHost}:${oPort}`;
+            const tun = net.connect(exit.port, exit.host);
+            let done = false;
+            const fail = (e) => { if (done)
+                return; done = true; tun.destroy(); cb(e); };
+            tun.setTimeout(EXIT_CONNECT_TIMEOUT_MS, () => fail(new Error(`exit ${exit.name} connect timeout`)));
+            tun.once("error", fail);
+            tun.once("connect", () => tun.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n\r\n`));
+            let buf = Buffer.alloc(0);
+            const onHdr = (chunk) => {
+                buf = Buffer.concat([buf, chunk]);
+                const i = buf.indexOf("\r\n\r\n");
+                if (i === -1)
+                    return;
+                tun.removeListener("data", onHdr);
+                const statusLine = buf.slice(0, i).toString("utf8").split("\r\n")[0] || "";
+                if (!/ 200/.test(statusLine)) {
+                    fail(new Error(`CONNECT via ${exit.name}: ${statusLine || "no status"}`));
+                    return;
+                }
+                tun.setTimeout(0);
+                tun.removeListener("error", fail);
+                const leftover = buf.slice(i + 4);
+                if (leftover.length)
+                    tun.unshift(leftover);
+                done = true;
+                if (!isTls) {
+                    cb(null, tun);
+                    return;
+                }
+                const s = tls.connect({ socket: tun, servername: options.servername || oHost, rejectUnauthorized: false });
+                // The raw tunnel socket keeps living UNDER the TLS socket, and node
+                // does NOT forward its 'error' events — an unhandled ECONNRESET on the
+                // lossy tunnel would CRASH the process. Fold it into a TLS teardown.
+                tun.on("error", () => { try {
+                    s.destroy();
+                }
+                catch { /* gone */ } });
+                s.once("secureConnect", () => { s.removeAllListeners("error"); cb(null, s); });
+                s.once("error", (e) => { s.destroy(); cb(e); });
+            };
+            tun.on("data", onHdr);
+        };
+        // lifo keeps the hottest (most recently proven alive) socket on top; the
+        // socket timeout culls idle pooled sockets the CDN has silently dropped.
+        const agentOpts = { keepAlive: true, keepAliveMsecs: 15_000, maxSockets: 8, maxFreeSockets: 6, scheduling: "lifo", timeout: 45_000 };
+        const a = isTls ? new https.Agent(agentOpts) : new http.Agent(agentOpts);
+        a.createConnection = mkConn;
+        exitAgents.set(key, a);
+        return a;
+    }
     // ---- HLS segment prefetch (plain-HTTP streams only) ------------------------
     // Fetch one URL through the region's exit pool, buffered, with failover.
-    // Rotates the starting exit across calls so concurrent prefetches spread over
-    // the fast pool and aggregate its bandwidth.
-    let prefetchRR = 0;
-    function fetchViaRegionBuffered(u, extraHeaders, label) {
+    function fetchViaRegionBuffered(u, extraHeaders, label, signal, exitHint) {
         return new Promise((resolvep, rejectp) => {
+            let settled = false;
+            let curReq = null;
+            let activeExit = null; // the exit whose active-count we've incremented
+            const uncount = () => { if (activeExit) {
+                activeExit.active = Math.max(0, activeExit.active - 1);
+                activeExit = null;
+            } };
+            const onAbort = () => { try {
+                curReq?.destroy();
+            }
+            catch { /* already gone */ } uncount(); finish(() => rejectp(new Error("aborted"))); };
+            const finish = (fn) => { if (settled)
+                return; settled = true; signal?.removeEventListener("abort", onAbort); fn(); };
+            const resolve = (r) => finish(() => resolvep(r));
+            const reject = (e) => finish(() => rejectp(e));
+            if (signal?.aborted) {
+                rejectp(new Error("aborted"));
+                return;
+            }
+            signal?.addEventListener("abort", onAbort);
             const host = u.hostname.toLowerCase();
             const isTls = u.protocol === "https:";
             const port = Number(u.port) || (isTls ? 443 : 80);
@@ -942,92 +1074,215 @@ export function startMultiExitRouter(opts) {
             if (region === "direct" && geoCn.peek(host) === true && fallbackRegion)
                 region = fallbackRegion;
             if (region === "direct" || !regionHasExits(region)) {
-                rejectp(new Error("no region for host"));
+                reject(new Error("no region for host"));
                 return;
             }
-            const base = pickOrder(region);
-            if (base.length === 0) {
-                rejectp(new Error("no healthy exit"));
+            const base0 = pickOrder(region);
+            if (base0.length === 0) {
+                reject(new Error("no healthy exit"));
                 return;
             }
-            const start = prefetchRR++ % Math.min(3, base.length);
-            const order = [...base.slice(start), ...base.slice(0, start)];
+            // Skip near-dead exits (measured below the floor) while a healthier exit
+            // exists, so a segment/stripe is never handed to a 0.1 Mbps exit that would
+            // stall the player. Unproven exits are kept (they get a chance; the caller's
+            // hedge covers them if they turn out dead).
+            // A striped range (exitHint set) pins to a DISTINCT exit across the FULL
+            // healthy pool (base0, already fastest-first, tripped exits excluded) so
+            // parallel ranges spread over ALL usable exits and aggregate — even the
+            // moderately-slow ones (0.4–0.6 Mbps) that we WANT for aggregation. A
+            // single (non-striped) fetch instead skips near-dead exits and rotates.
+            let order;
+            if (exitHint !== undefined) {
+                // Striped range: use pickOrder's live LOAD-AWARE order directly (base0 is
+                // sorted by speed/(active+1), least-loaded-fastest first). Because each
+                // buffered fetch now increments exit.active at connect time, concurrent
+                // stripes each see the prior stripe's load and pick the NEXT exit —
+                // spreading across DISTINCT exits and aggregating their bandwidth. (An
+                // explicit exitHint pin fought this: base0 reorders under load, so the
+                // pinned index kept landing back on the same fast exit.)
+                order = base0;
+            }
+            else {
+                // Load-aware order for whole fetches too: exit.active is incremented at
+                // DISPATCH, so when the prefetcher launches several segments in one tick
+                // the 2nd fetch already sees the 1st one's load and starts on the NEXT
+                // exit — concurrent segments spread across DISTINCT exits instead of
+                // splitting one exit's bandwidth N ways (observed: 3 segments all on
+                // 1.15 at ~1Mbps each while 1.16 sat idle). A blind RR rotation kept
+                // colliding because it ignored who was actually busy.
+                const fast = base0.filter((e) => e.speedEwma === null || e.speedEwma >= NEAR_DEAD_EXIT_BPS);
+                order = fast.length > 0 ? fast : base0;
+            }
             const path = (u.pathname || "/") + (u.search || "");
-            const target = `${host}:${port}`;
             const tail = (u.pathname || "/").split("/").pop() || path;
-            const tryIdx = (idx) => {
+            const tryIdx = (idx, round = 0) => {
+                if (settled)
+                    return;
                 if (idx >= order.length) {
-                    rejectp(new Error("all exits failed"));
+                    // On this lossy link (25–50% loss) a single pass can fail every exit by
+                    // bad luck; a fresh retry usually succeeds. Loop the whole exit order a
+                    // few rounds before giving up, so the player almost never sees a hard
+                    // failure (which trips its error watchdog → error.html → black screen).
+                    if (round + 1 < MAX_FETCH_ROUNDS) {
+                        const t = setTimeout(() => tryIdx(0, round + 1), 150);
+                        t.unref?.();
+                        return;
+                    }
+                    reject(new Error("all exits failed"));
                     return;
                 }
                 const exit = order[idx];
-                const tun = net.connect(exit.port, exit.host);
-                let moved = false;
-                const move = () => { if (!moved) {
-                    moved = true;
-                    tun.destroy();
-                    tryIdx(idx + 1);
+                // `order` is frozen at call start, but an exit can get FLOORED mid-call
+                // (it just trapped another fetch to its deadline). Skip it while a
+                // non-floored alternative exists in the order — otherwise the round
+                // loop replays the same dead exit for 13s × MAX_FETCH_ROUNDS while the
+                // good exits sit idle (observed: one segment held hostage for 52s).
+                if (exit.flooredAtMs !== null && order.some((e) => e.flooredAtMs === null)) {
+                    tryIdx(idx + 1, round);
+                    return;
+                }
+                // Count load NOW (at connect time, not at establishment) so that stripes
+                // dispatched together via Promise.all each see the prior stripe's load in
+                // pickOrder and spread across DISTINCT exits instead of all piling on the
+                // current fastest. Released in nextExit/commit/onAbort via uncount().
+                uncount();
+                activeExit = exit;
+                exit.active++;
+                let attemptDone = false;
+                let deadline = null;
+                const clearDeadline = () => { if (deadline) {
+                    clearTimeout(deadline);
+                    deadline = null;
                 } };
-                tun.setTimeout(EXIT_CONNECT_TIMEOUT_MS, move);
-                tun.once("connect", () => tun.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n\r\n`));
-                tun.on("error", move);
-                let buf = Buffer.alloc(0);
-                const onHdr = (chunk) => {
-                    buf = Buffer.concat([buf, chunk]);
-                    const i = buf.indexOf("\r\n\r\n");
-                    if (i === -1)
-                        return;
-                    tun.removeListener("data", onHdr);
-                    const statusLine = buf.slice(0, i).toString("utf8").split("\r\n")[0] || "";
-                    if (!/ 200/.test(statusLine)) {
-                        move();
+                // A deadline hit means this exit TRAPPED the fetch (accepted it, then
+                // trickled/hung for 10s+). Floor its score so it stops being handed
+                // segments (redemption after REDEMPTION_MS), then fail over.
+                const armDeadline = (ms) => { clearDeadline(); deadline = setTimeout(() => { floorExit(exit); nextExit("deadline"); }, ms); deadline.unref?.(); };
+                const t0 = Date.now();
+                // Ride the exit's keep-alive Agent: a pooled tunneled-TLS socket to this
+                // origin is reused instantly; only a cold (exit, origin) pair pays the
+                // TCP+CONNECT+TLS handshake. This is what makes playlist polls ~1 RTT
+                // and segment fetches transfer-bound instead of handshake-bound.
+                const reqFn = isTls ? https.request : http.request;
+                const up = reqFn({ host, port, path, method: "GET", headers: { ...extraHeaders, host: u.host }, agent: agentFor(exit, isTls) }, (upRes) => {
+                    if (attemptDone) {
+                        upRes.destroy();
                         return;
                     }
-                    moved = true; // established — failover window is over
-                    tun.setTimeout(0);
                     exit.lastSuccessMs = Date.now();
                     exit.fails = 0;
                     if (!exit.healthy)
                         exit.healthy = true;
                     exit.served++;
-                    const leftover = buf.slice(i + 4);
-                    if (leftover.length)
-                        tun.unshift(leftover);
-                    const t0 = Date.now();
-                    // For an https origin, run TLS over the exit tunnel so we speak
-                    // straight to the CDN (the exit only ever sees ciphertext). For http,
-                    // the raw tunnel socket carries plaintext HTTP directly.
-                    const reqFn = isTls ? https.request : http.request;
-                    const conn = isTls
-                        ? () => tls.connect({ socket: tun, servername: host, rejectUnauthorized: false })
-                        : () => tun;
-                    const up = reqFn({ host, port, path, method: "GET", headers: { ...extraHeaders, host: u.host }, createConnection: conn }, (upRes) => {
-                        const chunks = [];
-                        const meter = new RateMeter();
-                        upRes.on("data", (d) => { chunks.push(d); meter.add(d.length, Date.now()); });
-                        upRes.once("end", () => {
-                            const body = Buffer.concat(chunks);
-                            const durMs = Date.now() - t0;
-                            sampleSpeed(exit, meter, durMs);
-                            if (label) {
-                                const kb = (body.length / 1024).toFixed(0);
-                                const mbps = durMs > 0 ? ((body.length * 8) / durMs / 1000).toFixed(1) : "?";
-                                log(`  ${label} ${tail} via ${exit.name} — ${kb}KB in ${durMs}ms = ${mbps}Mbps`);
-                            }
-                            resolvep({ status: upRes.statusCode || 502, headers: upRes.headers, body });
-                        });
-                        upRes.once("error", (e) => rejectp(e));
+                    // Min-throughput deadline: once we know the body size, a body that
+                    // can't arrive at ~0.35 Mbps means the exit is trickling (dead
+                    // 0.1 Mbps 1.16) — abandon it and try the next, rather than hang
+                    // for a minute and clog the prefetch pipeline.
+                    const cl = Number(upRes.headers["content-length"]) || 0;
+                    armDeadline(cl > 0
+                        ? Math.min(FETCH_DEADLINE_MAX_MS, Math.max(FETCH_DEADLINE_MIN_MS, Math.ceil((cl * 8 / MIN_USEFUL_FETCH_BPS) * 1000) + 2000))
+                        : FETCH_DEADLINE_MAX_MS);
+                    const chunks = [];
+                    const meter = new RateMeter();
+                    upRes.on("data", (d) => { chunks.push(d); meter.add(d.length, Date.now()); });
+                    upRes.once("end", () => {
+                        const body = Buffer.concat(chunks);
+                        const durMs = Date.now() - t0;
+                        const status = upRes.statusCode || 502;
+                        if (body.length === 0 && status >= 200 && status < 300) {
+                            // A 2xx with an EMPTY body (e.g. an exit that can't serve this
+                            // byte-range, or a lossy link truncating it): DEPRIORITIZE the
+                            // exit by pinning its speed score to the floor, so pickOrder
+                            // stops sending stripes to it first and they go straight to an
+                            // exit that actually delivers — but KEEP it in the pool. The
+                            // moment it serves real bytes again, sampleSpeed lifts its score
+                            // back up. Then fail THIS request over to the next exit.
+                            floorExit(exit);
+                            nextExit(`empty ${status}`);
+                            return;
+                        }
+                        sampleSpeed(exit, meter, durMs);
+                        if (label) {
+                            const kb = (body.length / 1024).toFixed(0);
+                            const mbps = durMs > 0 ? ((body.length * 8) / durMs / 1000).toFixed(1) : "?";
+                            log(`  ${label} ${tail} via ${exit.name} — ${kb}KB in ${durMs}ms = ${mbps}Mbps`);
+                        }
+                        commit({ status, headers: upRes.headers, body });
                     });
-                    up.setTimeout(30_000, () => up.destroy(new Error("prefetch timeout")));
-                    up.on("error", (e) => rejectp(e));
-                    up.end();
+                    upRes.once("error", (e) => nextExit(`body: ${e.message}`));
+                });
+                curReq = up;
+                // Abandon this exit and try the next — connect/CONNECT/TLS failure, a
+                // mid-download error, no response headers, OR a min-throughput timeout
+                // (the exit is trickling too slowly to be useful; don't hang on it and
+                // clog the pipeline). Only when EVERY exit is exhausted do we reject.
+                // up.destroy() also removes the (possibly bad) socket from the pool.
+                const nextExit = (reason) => {
+                    if (attemptDone)
+                        return;
+                    attemptDone = true;
+                    clearDeadline();
+                    uncount();
+                    up.destroy();
+                    if (label)
+                        log(`  ${label} ${tail} via ${exit.name} FAILED after ${Date.now() - t0}ms (${reason ?? "?"}) → next exit`);
+                    tryIdx(idx + 1, round);
                 };
-                tun.on("data", onHdr);
+                const commit = (r) => {
+                    if (attemptDone)
+                        return;
+                    attemptDone = true;
+                    clearDeadline();
+                    uncount();
+                    // No destroy: the response was fully consumed, so the keep-alive
+                    // socket returns to the pool for the next fetch to this origin.
+                    resolve(r);
+                };
+                // Covers pooled-socket pickup OR the full cold handshake + response
+                // headers; the response callback re-arms with the size-based deadline.
+                armDeadline(FETCH_DEADLINE_MAX_MS);
+                up.on("error", (e) => nextExit(e.message));
+                up.end();
             };
             tryIdx(0);
         });
     }
-    const hls = new HlsPrefetcher(fetchViaRegionBuffered);
+    // Striping ON — PROVEN to aggregate: a 600KB range that takes 8.5s on one
+    // China exit (0.57 Mbps) lands in 3.9s when split 3 ways across exits
+    // (1.24 Mbps, 2.2×). The GFW throttles PER-CONNECTION, so parallel ranges on
+    // separate exit tunnels sum. A tiny 2-byte probe learns the size, then the
+    // whole body is pulled as parallel byte-ranges; each range is hedged
+    // (timeout → retry another exit) and the empty-body trip + min-throughput
+    // deadline in fetchViaRegionBuffered keep a dead/trickling exit from stalling
+    // it. Player requests JOIN an in-flight prefetch (dedup) so bandwidth isn't
+    // split fetching the same segment twice. concurrency:2 keeps at most 2
+    // segments (≈6 stripes over ~3 exits) in flight so the pool isn't overwhelmed.
+    const AGG = process.env.AGENTNET_HLS_STRIPES ? Math.max(1, Number(process.env.AGENTNET_HLS_STRIPES)) : 1;
+    // How many china exits are ACTUALLY delivering right now — healthy (or with
+    // live traffic), not tripped, and not speed-penalized (an exit that returned
+    // empty/0-byte gets its score floored, so it drops out here until it serves
+    // real bytes again). Striping splits a segment only this many ways: with one
+    // working exit → 1 (whole fetch, no serialized-stripe stall); as 1.16/1.17
+    // recover they rejoin and aggregation resumes automatically — nothing excluded.
+    const deliveringChinaExits = () => {
+        if (!fallbackRegion)
+            return 1;
+        const now = Date.now();
+        const n = exits.filter((e) => e.region === fallbackRegion && e.trippedUntil <= now &&
+            (e.healthy || (e.lastSuccessMs !== null && now - e.lastSuccessMs < RECENT_SUCCESS_MS)) &&
+            (e.speedEwma === null || e.speedEwma >= NEAR_DEAD_EXIT_BPS)).length;
+        return Math.max(1, n);
+    };
+    const usableChinaExits = () => Math.min(AGG, deliveringChinaExits());
+    // Prefetch parallelism = the number of exits ACTUALLY delivering right now
+    // (deliveringChinaExits). Each concurrent prefetch is a whole-segment fetch,
+    // and the load-aware exit pick (active++ at dispatch) lands each one on a
+    // DIFFERENT exit — so 3 working exits download 3 segments side by side and
+    // the stream rides the pool's aggregate bandwidth. With one working exit it
+    // degrades to one-at-a-time (full bandwidth per segment, no splitting —
+    // several fetches on ONE exit divide it N ways and everything stalls).
+    // prefetchAhead=3 matches the 3-segment live window CCTV publishes.
+    const hls = new HlsPrefetcher(fetchViaRegionBuffered, { stripes: AGG, stripesFn: usableChinaExits, stripeChunkBytes: 256 * 1024, concurrencyFn: deliveringChinaExits, prefetchAhead: 3 });
     let lastHlsHits = 0;
     function bumpHlsStats() {
         const s = hls.stats;
@@ -1045,15 +1300,45 @@ export function startMultiExitRouter(opts) {
     function serveHlsAware(o) {
         const { fullUrl, host, port, path, target, method, headers, req, res, order, isTls } = o;
         const u = new URL(fullUrl);
+        // The CCTV H5 player fetches segments via XHR/fetch (HLSP2P/DRM), so the
+        // browser enforces CORS. The CDN sends Access-Control-Allow-Origin, but our
+        // cache-hit and dedup-join serving paths only carried content-type — dropping
+        // it, so the browser blocked every cached segment ("No 'Access-Control-Allow-
+        // Origin' header", net::ERR_FAILED) and the player never got a decodable
+        // segment → black screen. Force the CORS headers on every HLS response.
+        const addCors = (h) => {
+            const origin = typeof headers["origin"] === "string" ? headers["origin"] : "*";
+            h["access-control-allow-origin"] = origin;
+            if (origin !== "*")
+                h["access-control-allow-credentials"] = "true";
+            h["access-control-expose-headers"] = "*";
+            h["timing-allow-origin"] = "*";
+        };
+        // Answer CORS preflights LOCALLY (204) instead of forwarding them to an exit
+        // — a preflight that hangs on a lossy China exit blocks the segment GET that
+        // follows it, starving the player. Instant 204 keeps segments flowing.
+        if (method === "OPTIONS") {
+            const h = { "content-length": 0 };
+            addCors(h);
+            h["access-control-allow-methods"] = "GET, HEAD, OPTIONS";
+            h["access-control-allow-headers"] = typeof headers["access-control-request-headers"] === "string"
+                ? headers["access-control-request-headers"] : "*";
+            h["access-control-max-age"] = "86400";
+            res.writeHead(204, h);
+            res.end();
+            return;
+        }
         const cacheable = method === "GET" && !headers["range"];
         if (cacheable) {
             const hit = hls.lookup(fullUrl);
             if (hit) {
-                res.writeHead(200, {
+                const hh = {
                     "content-type": hit.contentType ?? "application/octet-stream",
                     "content-length": hit.body.length,
                     "x-agentnet-cache": "hit",
-                });
+                };
+                addCors(hh);
+                res.writeHead(200, hh);
                 res.end(hit.body);
                 bumpHlsStats();
                 return;
@@ -1066,7 +1351,17 @@ export function startMultiExitRouter(opts) {
                     if (typeof v === "string" && ["user-agent", "referer", "origin", "cookie", "authorization"].includes(k))
                         fwd[k] = v;
                 }
-                fetchViaRegionBuffered(u, fwd, isPlaylist ? "playlist" : "segment")
+                // Playlists are tiny → one fetch. A cold segment gets an ABSOLUTE cap
+                // across all failover attempts so it can never hang the tab; the
+                // in-flight fetch keeps running and caches, so the player's re-request
+                // usually lands on a warm cache.
+                const fetchPromise = isPlaylist
+                    ? fetchViaRegionBuffered(u, fwd, "playlist")
+                    : Promise.race([
+                        hls.fetchSegmentStriped(fullUrl, fwd),
+                        new Promise((_, rej) => { const t = setTimeout(() => rej(new Error("segment total deadline")), SEGMENT_TOTAL_DEADLINE_MS); t.unref?.(); }),
+                    ]);
+                fetchPromise
                     .then((r) => {
                     log(`  MITM ${method} ${host}${(path || "/").slice(0, 80)} → ${r.status} (${r.body.length}B)`);
                     if (r.status >= 400) {
@@ -1076,6 +1371,7 @@ export function startMultiExitRouter(opts) {
                     const outHeaders = { ...r.headers };
                     delete outHeaders["transfer-encoding"];
                     outHeaders["content-length"] = r.body.length;
+                    addCors(outHeaders); // cache/dedup/striped paths drop the CDN's CORS header — always re-add
                     res.writeHead(r.status, outHeaders);
                     res.end(r.body);
                     if (r.status === 200) {
@@ -1099,10 +1395,20 @@ export function startMultiExitRouter(opts) {
                     }
                 })
                     .catch(() => {
-                    if (!res.headersSent)
-                        httpForwardViaExit(order, 0, target, host, port, path, req, res, headers, isTls);
-                    else
+                    if (res.headersSent) {
                         res.destroy();
+                        return;
+                    }
+                    // Playlists must succeed → fall back to a direct stream. A cold
+                    // segment that couldn't be fetched in time gets a fast 504 so the
+                    // player re-requests (likely a cache hit by then) instead of
+                    // hanging on an unbounded stream.
+                    if (isPlaylist)
+                        httpForwardViaExit(order, 0, target, host, port, path, req, res, headers, isTls);
+                    else {
+                        res.writeHead(504, { "content-length": 0 });
+                        res.end();
+                    }
                 });
                 return;
             }
@@ -1259,6 +1565,17 @@ export function startMultiExitRouter(opts) {
     });
     if (mode === "loadbalance") {
         const reporter = setInterval(() => {
+            // Redemption: lift an expired speed-floor back to "unproven" so the exit
+            // gets a fresh segment chance (only segments can re-prove it; without
+            // this a floor is a permanent exclusion, which we never want).
+            const rnow = Date.now();
+            for (const e of exits) {
+                if (e.flooredAtMs !== null && rnow - e.flooredAtMs > REDEMPTION_MS) {
+                    e.flooredAtMs = null;
+                    e.speedEwma = null;
+                    log(`${e.name}: floor lifted after ${Math.round(REDEMPTION_MS / 1000)}s — giving it another chance`);
+                }
+            }
             const parts = exits.filter((e) => e.healthy).map((e) => `${e.name}[${e.region}]: ${e.active} active / ${e.served} total / ${fmtMbps(e.speedEwma)}`);
             parts.push(`direct: ${directActive} active / ${directTotal} total`);
             log(`load — ${parts.join("  |  ")}`);

package/dist/ui/desktop/app.js

@@ -404,7 +404,7 @@ function RouteTag({ peer }) {
   const via = peer.via || "online";
   return /* @__PURE__ */ React.createElement(Tag, { tone: relay ? "warn" : "ok" }, peer.ping != null ? `${via} \xB7 ${peer.ping}ms` : via);
 }
-function Tag({ children, tone = "neutral", style }) {
+function Tag({ children, tone = "neutral", style, title }) {
   const tones = {
     neutral: { bg: "var(--chip)", fg: "var(--dim)", bd: "transparent" },
     ok: { bg: "color-mix(in oklab, var(--online), transparent 86%)", fg: "var(--online)", bd: "transparent" },
@@ -414,7 +414,7 @@ function Tag({ children, tone = "neutral", style }) {
     danger: { bg: "color-mix(in oklab, var(--danger), transparent 88%)", fg: "var(--danger)", bd: "transparent" }
   };
   const t = tones[tone] || tones.neutral;
-  return /* @__PURE__ */ React.createElement("span", { style: {
+  return /* @__PURE__ */ React.createElement("span", { title, style: {
     display: "inline-flex",
     alignItems: "center",
     gap: 4,
@@ -1480,9 +1480,14 @@ function PeerTable({ T, peers, onOpenChat }) {
   } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 10, minWidth: 0 } }, /* @__PURE__ */ React.createElement(DkAvatar, { peer: p, size: 26, radius: 6 }), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: p.alias ? "var(--ui)" : "var(--mono)", fontSize: 13, fontWeight: 600, color: "var(--text)", whiteSpace: "nowrap", overflow: "hidden", textOverflow: "ellipsis" } }, p.alias || shortKey(p.userId, 8, 5)), p.agent && /* @__PURE__ */ React.createElement(Icon, { name: "bot", size: 12, color: "var(--faint)", stroke: 2 })), /* @__PURE__ */ React.createElement(Mono, { size: 12.5, dim: true, copy: p.ip }, p.ip), /* @__PURE__ */ React.createElement("div", null, /* @__PURE__ */ React.createElement(RouteTag, { peer: p })), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11.5, color: p.wire === "64" ? "var(--warn)" : "var(--dim)" } }, p.wire === "64" ? "old\xB764" : "new\xB7163"), /* @__PURE__ */ React.createElement("div", { style: { display: "flex", justifyContent: "flex-end", gap: 6 } }, /* @__PURE__ */ React.createElement(Btn, { icon: "message", size: "sm", title: T.openChat, onClick: () => onOpenChat(p.id) }), /* @__PURE__ */ React.createElement(Btn, { icon: "signal", size: "sm", title: T.ping })))));
 }
 function ExitCard({ T, region, activeExit, onSetExit }) {
-  return /* @__PURE__ */ React.createElement("div", { style: { borderRadius: 11, border: "1px solid var(--line)", overflow: "hidden", background: "var(--panel)" } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 10, padding: "11px 14px", borderBottom: "1px solid var(--line)", background: "var(--panel-2)" } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, fontWeight: 700, letterSpacing: 0.5, padding: "2px 7px", borderRadius: 5, background: "var(--chip)", color: "var(--dim)" } }, region.flag), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--ui)", fontSize: 13.5, fontWeight: 600, color: "var(--text)" } }, region.label), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, color: "var(--faint)" } }, region.nodes.filter((n) => n.online).length, "/", region.nodes.length, " ", T.up)), /* @__PURE__ */ React.createElement("div", null, region.nodes.map((n, i) => {
+  return /* @__PURE__ */ React.createElement("div", { style: { borderRadius: 11, border: "1px solid var(--line)", overflow: "hidden", background: "var(--panel)" } }, /* @__PURE__ */ React.createElement("div", { style: { display: "flex", alignItems: "center", gap: 10, padding: "11px 14px", borderBottom: "1px solid var(--line)", background: "var(--panel-2)" } }, /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, fontWeight: 700, letterSpacing: 0.5, padding: "2px 7px", borderRadius: 5, background: "var(--chip)", color: "var(--dim)" } }, region.flag), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--ui)", fontSize: 13.5, fontWeight: 600, color: "var(--text)" } }, region.label), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), (() => {
+    const reach = region.nodes.filter((n) => n.reachable).length;
+    const down = region.nodes.length - reach;
+    return /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, color: down > 0 ? "var(--warn)" : "var(--faint)" } }, reach, "/", region.nodes.length, " ", T.up, down > 0 ? ` \xB7 ${down} down` : "");
+  })()), /* @__PURE__ */ React.createElement("div", null, region.nodes.map((n, i) => {
     const active = n.ip === activeExit;
-    return /* @__PURE__ */ React.createElement("div", { key: n.ip, style: { display: "flex", alignItems: "center", gap: 12, padding: "10px 14px", borderBottom: i < region.nodes.length - 1 ? "1px solid var(--line)" : "none", background: active ? "color-mix(in oklab, var(--accent), transparent 92%)" : "transparent" } }, /* @__PURE__ */ React.createElement(StatusDot, { online: n.online }), /* @__PURE__ */ React.createElement(Mono, { size: 13, copy: n.ip }, n.ip), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, color: "var(--faint)" } }, n.host), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), n.online ? /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11.5, color: n.ping > 200 ? "var(--warn)" : "var(--dim)" } }, n.ping, "ms") : /* @__PURE__ */ React.createElement(Tag, { tone: "off" }, "offline"), active ? /* @__PURE__ */ React.createElement(Btn, { tone: "ok", icon: "check", size: "sm", onClick: () => onSetExit(null) }, T.routing) : /* @__PURE__ */ React.createElement(Btn, { size: "sm", icon: "route", onClick: () => n.online && onSetExit(n.ip), style: { opacity: n.online ? 1 : 0.4 } }, T.routeThru));
+    const stuck = n.online && !n.reachable;
+    return /* @__PURE__ */ React.createElement("div", { key: n.ip, style: { display: "flex", alignItems: "center", gap: 12, padding: "10px 14px", borderBottom: i < region.nodes.length - 1 ? "1px solid var(--line)" : "none", background: active ? "color-mix(in oklab, var(--accent), transparent 92%)" : "transparent" } }, /* @__PURE__ */ React.createElement(StatusDot, { online: n.reachable }), /* @__PURE__ */ React.createElement(Mono, { size: 13, copy: n.ip }, n.ip), /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11, color: "var(--faint)" } }, n.host), /* @__PURE__ */ React.createElement("div", { style: { flex: 1 } }), n.reachable ? /* @__PURE__ */ React.createElement("span", { style: { fontFamily: "var(--mono)", fontSize: 11.5, color: n.ping > 200 ? "var(--warn)" : "var(--dim)" } }, n.ping, "ms") : stuck ? /* @__PURE__ */ React.createElement(Tag, { tone: "warn", title: "Announces online but IP won't pass \u2014 session desync or NAT-blocked" }, "online \xB7 no route") : /* @__PURE__ */ React.createElement(Tag, { tone: "off" }, "offline"), active ? /* @__PURE__ */ React.createElement(Btn, { tone: "ok", icon: "check", size: "sm", onClick: () => onSetExit(null) }, T.routing) : /* @__PURE__ */ React.createElement(Btn, { size: "sm", icon: "route", onClick: () => n.reachable && onSetExit(n.ip), style: { opacity: n.reachable ? 1 : 0.4 } }, T.routeThru));
   })));
 }
 function NetworkTab({ T, me, peers, exits, activeExit, reqCount, onSetExit, onOpenChat }) {

package/dist/ui/server.js

@@ -13,6 +13,7 @@
 // empty because the daemon accepts immediately.
 //
 import http from "node:http";
+import net from "node:net";
 import { existsSync, readFileSync, writeFileSync, statSync, createReadStream } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -21,6 +22,11 @@ import { DEFAULT_EXITS } from "../config/loader.js";
 // Directory holding the built desktop UI bundle (index.html, app.js, vendor/).
 // scripts/build-ui.mjs emits it next to this compiled module at dist/ui/desktop/.
 const DESKTOP_DIR = join(dirname(fileURLToPath(import.meta.url)), "desktop");
+// Exit reachability probe: the CONNECT-proxy port every exit runs, and how long
+// to wait before calling an exit unreachable. Kept short so the network panel
+// (which probes all exits on each poll) stays responsive over a lossy mesh.
+const EXIT_PROBE_PORT = 8888;
+const EXIT_PROBE_TIMEOUT_MS = 2000;
 /** True only when the request came from the local machine. Used to gate the
  *  "Sign in with Decent" routes so binding the UI to a LAN IP can't expose
  *  identity signing to other hosts. The popup always runs in the local user's
@@ -561,6 +567,7 @@ export function startFriendUi(opts) {
                         ip: e.virtual_ip,
                         host: e.name,
                         online: onlineUserids.has(e.userid) || onlineIps.has(e.virtual_ip),
+                        reachable: false,
                         ping: null,
                     });
                 }
@@ -573,14 +580,44 @@ export function startFriendUi(opts) {
                         knownIps.add(ip);
                         if (!byRegion.has(r.name))
                             byRegion.set(r.name, []);
-                        byRegion.get(r.name).push({ ip, host: ip, online: onlineIps.has(ip), ping: null });
+                        byRegion.get(r.name).push({ ip, host: ip, online: onlineIps.has(ip), reachable: false, ping: null });
                     }
                 }
+                // REACHABILITY (data plane): presence "online" only means the peer is
+                // announcing on the DHT — it does NOT mean IP packets get through (a
+                // desynced/NAT-blocked exit shows "online" while `ping 10.86.x` times out,
+                // e.g. GFAX). Actively probe each exit's CONNECT-proxy port over the mesh:
+                // a completed TCP handshake proves the L3 path + the exit process are both
+                // live. Probed in parallel with a short timeout so the panel stays snappy.
+                const allNodes = [...byRegion.values()].flat();
+                await Promise.all(allNodes.map((n) => new Promise((done) => {
+                    const t0 = Date.now();
+                    const sock = net.connect({ host: n.ip, port: EXIT_PROBE_PORT });
+                    let settled = false;
+                    const finish = (ok) => {
+                        if (settled)
+                            return;
+                        settled = true;
+                        clearTimeout(timer);
+                        sock.destroy();
+                        n.reachable = ok;
+                        n.ping = ok ? Date.now() - t0 : null;
+                        done();
+                    };
+                    const timer = setTimeout(() => finish(false), EXIT_PROBE_TIMEOUT_MS);
+                    sock.once("connect", () => finish(true));
+                    // ECONNREFUSED means the host answered (L3 reachable) but the proxy
+                    // isn't listening — still "reachable" for triage; a timeout/no-route is
+                    // the real "can't connect".
+                    sock.once("error", (e) => finish(e.code === "ECONNREFUSED"));
+                })));
                 const exits = [...byRegion.entries()].map(([region, nodes]) => ({
                     region,
                     flag: regionMeta[region]?.flag ?? region.slice(0, 2).toUpperCase(),
                     label: regionMeta[region]?.label ?? region,
                     nodes,
+                    reachableCount: nodes.filter((n) => n.reachable).length,
+                    unreachableCount: nodes.filter((n) => !n.reachable).length,
                 }));
                 const activeExit = routes.default && routes.default !== "direct" ? routes.default : null;
                 sendJson(res, 200, { me, peers, requests, exits, activeExit });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.184",
+  "version": "0.1.187",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",
@@ -79,7 +79,7 @@
   },
   "dependencies": {
     "@decentnetwork/dora": "^0.1.13",
-    "@decentnetwork/peer": "^0.1.91",
+    "@decentnetwork/peer": "^0.1.92",
     "@decentnetwork/peer-webrtc": "^0.2.10",
     "ink": "^5.2.1",
     "js-yaml": "^4.1.0",