@decentnetwork/lan 0.1.193 → 0.1.195

package/dist/cli/commands.js

@@ -2,7 +2,7 @@
  * CLI command handlers
  */
 import { resolve, dirname, join } from "path";
-import { existsSync, mkdirSync, readFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs";
 import { createConnection } from "net";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
@@ -1421,6 +1421,37 @@ export async function cmdProxyTrustCa(args) {
         return;
     }
     if (process.platform === "linux") {
+        // WSL: the browser runs on the WINDOWS side and trusts the WINDOWS cert
+        // store — installing into this distro's Linux store does nothing for it.
+        // certutil.exe is callable from WSL and the per-user ROOT store needs no
+        // admin (Windows pops a confirmation dialog the user must accept).
+        const isWsl = existsSync("/proc/version") &&
+            readFileSync("/proc/version", "utf-8").toLowerCase().includes("microsoft");
+        if (isWsl) {
+            const winCopy = "/mnt/c/Users/Public/agentnet-mitm-ca.pem";
+            const winPath = "C:\\Users\\Public\\agentnet-mitm-ca.pem";
+            console.log("WSL detected — the browser lives on Windows, installing into the Windows user trust store.");
+            try {
+                copyFileSync(caCertPath, winCopy);
+                console.log("A Windows security dialog will pop up — click Yes to trust the CA...");
+                const w = spawnSync("certutil.exe", ["-user", "-addstore", "-f", "ROOT", winPath], { stdio: "inherit" });
+                if (w.status === 0) {
+                    console.log("✓ Windows store updated. Chrome/Edge on Windows pick it up immediately (reload the page).");
+                }
+                else {
+                    console.log("Install failed or dialog declined — in a Windows terminal run:");
+                    console.log(`  certutil -user -addstore -f ROOT "${winPath}"`);
+                }
+            }
+            catch (e) {
+                console.log(`Could not copy the cert to the Windows side (${e.message}). Manually:`);
+                console.log(`  cp "${caCertPath}" ${winCopy}`);
+                console.log(`  certutil.exe -user -addstore -f ROOT "${winPath}"`);
+            }
+            console.log("(Linux-side clients like curl inside WSL would additionally need the system CA store:");
+            console.log(`  sudo cp "${caCertPath}" /usr/local/share/ca-certificates/agentnet-mitm-ca.crt && sudo update-ca-certificates)`);
+            return;
+        }
         console.log("Installing into the system CA store (asks for your sudo password)...");
         const cp = spawnSync("sudo", ["cp", caCertPath, "/usr/local/share/ca-certificates/agentnet-mitm-ca.crt"], { stdio: "inherit" });
         const up = cp.status === 0 ? spawnSync("sudo", ["update-ca-certificates"], { stdio: "inherit" }) : cp;
@@ -1431,8 +1462,20 @@ export async function cmdProxyTrustCa(args) {
         console.log("(package: libnss3-tools). Firefox: Settings → Certificates → Import.");
         return;
     }
-    console.log("Windows: import the cert into 'Trusted Root Certification Authorities':");
-    console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+    if (process.platform === "win32") {
+        console.log("Installing into the Windows user trust store (a security dialog will pop up — click Yes)...");
+        const w = spawnSync("certutil", ["-user", "-addstore", "-f", "ROOT", caCertPath], { stdio: "inherit" });
+        if (w.status === 0) {
+            console.log("✓ Trusted. Chrome/Edge pick it up immediately (reload the page).");
+        }
+        else {
+            console.log("Install failed or dialog declined — run manually (admin terminal for the machine store):");
+            console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+        }
+        return;
+    }
+    console.log(`Unsupported platform ${process.platform} — import this CA into your browser's trust store manually:`);
+    console.log(`  ${caCertPath}`);
 }
 export async function cmdProxyRouter(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();

package/dist/proxy/hls-prefetch.d.ts

@@ -20,6 +20,15 @@ export interface HlsVariant {
  * Returns [] for a media playlist (no variants).
  */
 export declare function parseM3u8Variants(playlist: string, baseUrl: string): HlsVariant[];
+/** Remove master-playlist variants above a delivery-safe bandwidth. Variant
+ *  metadata and its following URI are removed as one pair. Media playlists are
+ *  returned unchanged. */
+export declare function capM3u8Variants(playlist: string, maxBandwidth: number): string;
+/** Map variants above the delivery cap to the fastest variant that remains.
+ * Some players keep polling a previously selected media-playlist URL even after
+ * reloading the capped master playlist. The proxy can use this map to fetch the
+ * safe media playlist while preserving the browser-facing request URL. */
+export declare function buildM3u8VariantFallbacks(playlist: string, baseUrl: string, maxBandwidth: number): Map<string, string>;
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those
@@ -53,15 +62,15 @@ export interface HlsPrefetcherOptions {
      *  exit pool (default 4). 1 disables striping. Lets ONE segment ride the SUM
      *  of the exits' bandwidth instead of a single throttled connection. */
     stripes?: number;
-    /** Dynamic stripe count: returns how many exits are ACTUALLY delivering right
-     *  now, so a segment is split only as many ways as there are working exits.
-     *  With one working exit it returns 1 (whole fetch — striping onto a single
-     *  exit just serializes and stalls); as exits recover it rises and aggregation
-     *  resumes. Overrides `stripes` when provided. */
+    /** Dynamic stripe count: may reflect either distinct exits or parallel
+     *  connections on one proven exit. Overrides `stripes` when provided. */
     stripesFn?: () => number;
     /** Delay before duplicating a slow whole-segment fetch. Primarily exposed for
      *  deterministic tests; default 3.5s is just below CCTV's 4s live segment. */
     wholeHedgeMs?: number;
+    /** Delay before duplicating a slow byte range. Exposed for deterministic
+     *  tests; default 2s leaves time for the rescue to beat a 4s live segment. */
+    stripeHedgeMs?: number;
     /** Stripe chunk size — also the first probe chunk (default 256 KB). Segments
      *  smaller than this aren't striped. */
     stripeChunkBytes?: number;
@@ -89,6 +98,13 @@ export declare class HlsPrefetcher {
      *  lands — lets a player request "join" an in-flight prefetch instead of
      *  double-downloading. */
     pending(url: string): Promise<CacheEntry | null> | null;
+    /** Delay only the first response for a media-playlist URL while caching up to
+     *  two of its oldest listed segments. This intentionally starts playback
+     *  about 4-8 seconds behind the live edge, giving the player enough media
+     *  buffer to absorb an occasional link-wide five-second slowdown. Later
+     *  refreshes are never delayed. A fetch that outlives the wait remains tracked
+     *  so the player's segment request joins it instead of downloading twice. */
+    primePlaylist(playlistUrl: string, body: string, maxWaitMs?: number, targetSegments?: number): Promise<number>;
     /** Called with every playlist body that passes through the router: parse it
      *  and top up the prefetch pipeline for its upcoming segments. */
     onPlaylist(playlistUrl: string, body: string): void;

package/dist/proxy/hls-prefetch.js

@@ -23,6 +23,9 @@ const SEGMENT_EXTS = [".ts", ".m4s", ".m4a", ".m4v", ".aac", ".mp3", ".mp4", ".v
 const STRIPE_DEADLINE_MS = 6000;
 /** How many exits to try for one stripe before giving up on it. */
 const STRIPE_TRIES = 3;
+/** Start a duplicate of the same half-range before the four-second live buffer
+ * is exhausted. The first byte-correct response wins and aborts its siblings. */
+const STRIPE_HEDGE_MS = 2000;
 /** Whole-segment hedge delay: a live segment is ~4s of video; one that hasn't
  *  landed in this long is late (a healthy exit delivers in 1-3.5s), so a
  *  parallel duplicate on another exit is launched. Rarely fires in steady
@@ -78,6 +81,53 @@ export function parseM3u8Variants(playlist, baseUrl) {
     }
     return out;
 }
+/** Remove master-playlist variants above a delivery-safe bandwidth. Variant
+ *  metadata and its following URI are removed as one pair. Media playlists are
+ *  returned unchanged. */
+export function capM3u8Variants(playlist, maxBandwidth) {
+    if (!playlist.includes("#EXT-X-STREAM-INF") || maxBandwidth <= 0)
+        return playlist;
+    const out = [];
+    let dropUri = false;
+    for (const line of playlist.split(/\r?\n/)) {
+        if (line.trim().startsWith("#EXT-X-STREAM-INF")) {
+            const bw = /BANDWIDTH=(\d+)/.exec(line);
+            dropUri = Boolean(bw && Number(bw[1]) > maxBandwidth);
+            if (!dropUri)
+                out.push(line);
+            continue;
+        }
+        if (dropUri) {
+            if (line.trim().length === 0 || line.trim().startsWith("#"))
+                continue;
+            dropUri = false;
+            continue;
+        }
+        out.push(line);
+    }
+    return out.join("\n");
+}
+/** Map variants above the delivery cap to the fastest variant that remains.
+ * Some players keep polling a previously selected media-playlist URL even after
+ * reloading the capped master playlist. The proxy can use this map to fetch the
+ * safe media playlist while preserving the browser-facing request URL. */
+export function buildM3u8VariantFallbacks(playlist, baseUrl, maxBandwidth) {
+    const out = new Map();
+    if (maxBandwidth <= 0)
+        return out;
+    const variants = parseM3u8Variants(playlist, baseUrl).filter((v) => v.url.length > 0);
+    const allowed = variants
+        .filter((v) => v.bandwidth <= maxBandwidth)
+        .sort((a, b) => b.bandwidth - a.bandwidth);
+    const fallback = allowed[0];
+    if (!fallback)
+        return out;
+    for (const variant of variants) {
+        if (variant.bandwidth > maxBandwidth)
+            out.set(variant.url, fallback.url);
+    }
+    return out;
+}
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those
@@ -104,6 +154,7 @@ export class HlsPrefetcher {
     #cache = new Map(); // Map preserves insertion order → LRU-ish
     #cacheBytes = 0;
     #inflight = new Map();
+    #liveBufferPrimed = false;
     #fetcher;
     #maxBytes;
     #ttlMs;
@@ -115,6 +166,7 @@ export class HlsPrefetcher {
     #stripesFn;
     #stripeChunkBytes;
     #wholeHedgeMs;
+    #stripeHedgeMs;
     #hits = 0;
     #misses = 0;
     constructor(fetcher, opts = {}) {
@@ -129,6 +181,7 @@ export class HlsPrefetcher {
         this.#stripesFn = opts.stripesFn;
         this.#stripeChunkBytes = opts.stripeChunkBytes ?? 256 * 1024;
         this.#wholeHedgeMs = opts.wholeHedgeMs ?? WHOLE_HEDGE_MS;
+        this.#stripeHedgeMs = opts.stripeHedgeMs ?? STRIPE_HEDGE_MS;
     }
     /** Effective stripe count right now (dynamic if a stripesFn was provided). */
     #stripeCount() {
@@ -244,27 +297,73 @@ export class HlsPrefetcher {
      *  STRIPE_TRIES exits. Returns null only if every try failed. `exactLen`, when
      *  given, rejects a 206 whose body isn't exactly that long (so assembly is
      *  byte-correct); the probe passes it undefined to accept whatever 206 arrives. */
-    async #fetchRange(u, start, end, extra, exactLen, exitHint) {
-        for (let t = 0; t < STRIPE_TRIES; t++) {
-            const ac = new AbortController();
-            const timer = setTimeout(() => ac.abort(), STRIPE_DEADLINE_MS);
-            timer.unref?.();
-            try {
-                // Each retry shifts to the NEXT exit so a failed range moves off a bad one.
-                const hint = exitHint === undefined ? undefined : exitHint + t;
-                const r = await this.#fetcher(u, { ...extra, host: u.host, range: `bytes=${start}-${end}` }, "stripe", ac.signal, hint);
-                clearTimeout(timer);
-                if (r.status === 200)
-                    return r; // origin ignored Range → whole body
-                if (r.status === 206 && (exactLen === undefined || r.body.length === exactLen))
-                    return r;
-                // wrong status/length → try another exit
-            }
-            catch {
-                clearTimeout(timer);
-            }
-        }
-        return null;
+    #fetchRange(u, start, end, extra, exactLen, exitHint) {
+        return new Promise((resolve) => {
+            let settled = false;
+            let launched = 0;
+            let finished = 0;
+            let hedgeTimer = null;
+            const controllers = [];
+            const clearHedge = () => { if (hedgeTimer) {
+                clearTimeout(hedgeTimer);
+                hedgeTimer = null;
+            } };
+            const finish = (r, winner) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearHedge();
+                for (const ac of controllers)
+                    if (ac !== winner)
+                        ac.abort();
+                resolve(r);
+            };
+            const scheduleHedge = () => {
+                if (settled || launched >= STRIPE_TRIES || hedgeTimer)
+                    return;
+                hedgeTimer = setTimeout(() => { hedgeTimer = null; launch(); }, this.#stripeHedgeMs);
+                hedgeTimer.unref?.();
+            };
+            const launch = () => {
+                if (settled || launched >= STRIPE_TRIES)
+                    return;
+                const attempt = launched++;
+                const ac = new AbortController();
+                controllers.push(ac);
+                const deadline = setTimeout(() => ac.abort(), STRIPE_DEADLINE_MS);
+                deadline.unref?.();
+                // A hedge is another connection for the SAME bytes. Router-side live
+                // ordering keeps it on the proven pool and may select another proven
+                // exit when one exists.
+                const hint = exitHint === undefined ? undefined : exitHint + attempt;
+                void this.#fetcher(u, { ...extra, host: u.host, range: `bytes=${start}-${end}` }, "stripe", ac.signal, hint)
+                    .then((r) => {
+                    clearTimeout(deadline);
+                    if (settled)
+                        return;
+                    if (r.status === 200 || (r.status === 206 && (exactLen === undefined || r.body.length === exactLen))) {
+                        finish(r, ac);
+                        return;
+                    }
+                    failed();
+                }, () => { clearTimeout(deadline); failed(); });
+                scheduleHedge();
+            };
+            const failed = () => {
+                if (settled)
+                    return;
+                finished++;
+                // A hard failure should not wait for the hedge delay.
+                if (launched < STRIPE_TRIES) {
+                    clearHedge();
+                    launch();
+                    return;
+                }
+                if (finished >= launched)
+                    finish(null);
+            };
+            launch();
+        });
     }
     /** Split a segment into `stripes` parallel byte-ranges across the exit pool,
      *  each hedged. Assembles them into the full body with a corrected
@@ -272,9 +371,8 @@ export class HlsPrefetcher {
      *  any stripe truly can't be fetched (correctness over speed). */
     async #stripeFetch(u, extra) {
         const stripeCount = this.#stripeCount();
-        // Only ONE exit is delivering right now → striping would split the segment
-        // onto a single exit that serializes the parts (14s vs a 2.4s whole fetch).
-        // Just fetch the whole segment; aggregation resumes when a 2nd exit recovers.
+        // A count of one explicitly disables striping (emergency rollback or an
+        // origin/path known not to benefit from parallel range connections).
         if (stripeCount <= 1)
             return this.#whole(u, extra);
         // Tiny probe (2 bytes): learn the total size + confirm the origin honors
@@ -339,6 +437,50 @@ export class HlsPrefetcher {
     pending(url) {
         return this.#inflight.get(url) ?? null;
     }
+    /** Delay only the first response for a media-playlist URL while caching up to
+     *  two of its oldest listed segments. This intentionally starts playback
+     *  about 4-8 seconds behind the live edge, giving the player enough media
+     *  buffer to absorb an occasional link-wide five-second slowdown. Later
+     *  refreshes are never delayed. A fetch that outlives the wait remains tracked
+     *  so the player's segment request joins it instead of downloading twice. */
+    async primePlaylist(playlistUrl, body, maxWaitMs = 8000, targetSegments = 2) {
+        const segs = parseM3u8Segments(body, playlistUrl).slice(-this.#ahead);
+        if (segs.length === 0)
+            return 0;
+        // One global prime only. CCTV probes/switches several variant and backup-CDN
+        // playlist URLs during startup; priming each URL independently launched
+        // 600/1350/576/1800 segments together and created the very congestion this
+        // buffer is intended to absorb.
+        if (this.#liveBufferPrimed) {
+            this.onPlaylist(playlistUrl, body);
+            return 0;
+        }
+        this.#liveBufferPrimed = true;
+        const deadline = Date.now() + Math.max(0, maxWaitMs);
+        let ready = 0;
+        for (const url of segs.slice(0, Math.max(1, targetSegments))) {
+            if (this.#peek(url)) {
+                ready++;
+                continue;
+            }
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                break;
+            const timeout = new Promise((resolve) => {
+                const t = setTimeout(() => resolve(null), remaining);
+                t.unref?.();
+            });
+            const fetched = await Promise.race([
+                this.fetchSegmentStriped(url).then((r) => r.status === 200 && r.body.length > 0 ? r : null),
+                timeout,
+            ]);
+            if (!fetched)
+                break;
+            ready++;
+        }
+        this.onPlaylist(playlistUrl, body);
+        return ready;
+    }
     #peek(url) {
         const e = this.#cache.get(url);
         if (!e)

package/dist/proxy/multi-exit-router.js

@@ -21,7 +21,7 @@ import https from "node:https";
 import net from "node:net";
 import tls from "node:tls";
 import { egressConnect } from "./egress.js";
-import { HlsPrefetcher, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments } from "./hls-prefetch.js";
+import { HlsPrefetcher, buildM3u8VariantFallbacks, capM3u8Variants, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments } from "./hls-prefetch.js";
 import { RouteLearner } from "./route-learner.js";
 import { GeoCnClassifier } from "./geo-cn.js";
 import { MitmGateway } from "./mitm-gateway.js";
@@ -155,7 +155,15 @@ const NEAR_DEAD_EXIT_BPS = 60_000;
 // buffer. Keep such exits available for last-resort failover, but do not count
 // them as HLS delivery capacity or let a slow redemption probe re-enable them.
 // This is bytes/sec (150 KB/s = 1.2 Mbit/s).
-const HLS_DELIVERY_BPS = 150_000;
+// A foreground HD exit must sustain at least 1.6 Mbit/s. The former 1.2 Mbit/s
+// threshold admitted 10.86.15.133 on a short peak even though its full CCTV
+// segments averaged only 0.7-1.2 Mbit/s, causing each half-range to take 4-6s.
+const HLS_DELIVERY_BPS = 200_000;
+// Stability-first default for constrained exit pools. Set 0 to expose every
+// origin variant, or 1800000 to restore CCTV 720P when another fast exit joins.
+const HLS_MAX_VARIANT_BPS = process.env.AGENTNET_HLS_MAX_BPS === undefined
+    ? 900_000
+    : Math.max(0, Number(process.env.AGENTNET_HLS_MAX_BPS));
 export function isUsefulRecoverySample(peakBps, averageBps, minBps = HLS_DELIVERY_BPS) {
     return peakBps >= minBps && averageBps >= minBps;
 }
@@ -262,9 +270,26 @@ function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS) {
  * exit is degraded, keep the original pool as a last resort. Exported for the
  * policy regression tests. */
 export function selectHlsPrimaryPool(pool) {
+    const fastestTier = (candidates) => {
+        const best = Math.max(...candidates.map((e) => e.speedEwma ?? 0));
+        return candidates.filter((e) => (e.speedEwma ?? 0) >= best * 0.8);
+    };
     const proven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma !== null && e.speedEwma >= HLS_DELIVERY_BPS);
-    if (proven.length > 0)
-        return proven;
+    if (proven.length > 0) {
+        // A fixed floor alone is not enough: a marginal path can briefly cross it
+        // while remaining far slower than the best live path, then hold one stripe
+        // hostage. Keep only the fastest tier (within 80% of the current best).
+        // Similar-speed exits can still aggregate; a clearly slower one is reserved
+        // for background redemption/failover.
+        return fastestTier(proven);
+    }
+    // If every measured path is below the HD floor, the best measured path is
+    // still safer than falling back to every unproven/degraded exit. This is the
+    // adaptive-bitrate path: the master playlist is capped separately, while
+    // foreground delivery stays on the least-bad known tier.
+    const measured = pool.filter((e) => e.flooredAtMs === null && e.speedEwma !== null);
+    if (measured.length > 0)
+        return fastestTier(measured);
     const unproven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma === null);
     return unproven.length > 0 ? unproven : pool;
 }
@@ -1174,24 +1199,22 @@ export function startMultiExitRouter(opts) {
             // exists, so a segment/stripe is never handed to a 0.1 Mbps exit that would
             // stall the player. Unproven exits are kept (they get a chance; the caller's
             // hedge covers them if they turn out dead).
-            // A striped range (exitHint set) pins to a DISTINCT exit across the FULL
-            // healthy pool (base0, already fastest-first, tripped exits excluded) so
-            // parallel ranges spread over ALL usable exits and aggregate — even the
-            // moderately-slow ones (0.4–0.6 Mbps) that we WANT for aggregation. A
-            // single (non-striped) fetch instead skips near-dead exits and rotates.
+            // Foreground HLS traffic must stay on the proven delivery pool. In
+            // particular, a stripe must not borrow a marginal/unproven exit merely to
+            // obtain a second path: one 0.1 Mbps half-range holds the entire assembled
+            // segment hostage. Multiple range connections may still share one proven
+            // exit; that is intentional because the observed long tail is per
+            // connection and the CDN supports byte ranges.
             let order;
             if (forcedExit) {
                 order = base0;
             }
             else if (exitHint !== undefined) {
-                // Striped range: use pickOrder's live LOAD-AWARE order directly (base0 is
-                // sorted by speed/(active+1), least-loaded-fastest first). Because each
-                // buffered fetch now increments exit.active at connect time, concurrent
-                // stripes each see the prior stripe's load and pick the NEXT exit —
-                // spreading across DISTINCT exits and aggregating their bandwidth. (An
-                // explicit exitHint pin fought this: base0 reorders under load, so the
-                // pinned index kept landing back on the same fast exit.)
-                order = base0;
+                // Keep the live load-aware ordering, but filter it through the same
+                // foreground-safe policy as whole segments. With one proven exit both
+                // stripes use separate connections through it; with two proven exits
+                // active-count ordering naturally spreads the stripes.
+                order = selectHlsPrimaryPool(base0);
             }
             else {
                 // Load-aware order for whole fetches too: exit.active is incremented at
@@ -1348,7 +1371,7 @@ export function startMultiExitRouter(opts) {
     // it. Player requests JOIN an in-flight prefetch (dedup) so bandwidth isn't
     // split fetching the same segment twice. concurrency:2 keeps at most 2
     // segments (≈6 stripes over ~3 exits) in flight so the pool isn't overwhelmed.
-    const AGG = process.env.AGENTNET_HLS_STRIPES ? Math.max(1, Number(process.env.AGENTNET_HLS_STRIPES)) : 1;
+    const AGG = process.env.AGENTNET_HLS_STRIPES ? Math.max(1, Number(process.env.AGENTNET_HLS_STRIPES)) : 3;
     // How many china exits are ACTUALLY delivering right now — healthy (or with
     // live traffic), not tripped, and not speed-penalized (an exit that returned
     // empty/0-byte gets its score floored, so it drops out here until it serves
@@ -1363,7 +1386,23 @@ export function startMultiExitRouter(opts) {
             (e.healthy || (e.lastSuccessMs !== null && now - e.lastSuccessMs < RECENT_SUCCESS_MS)));
         return countHlsDeliveryExits(eligible);
     };
-    const usableChinaExits = () => Math.min(AGG, deliveringChinaExits());
+    const hasMeasuredChinaExit = () => {
+        if (!fallbackRegion)
+            return false;
+        const now = Date.now();
+        return exits.some((e) => e.region === fallbackRegion && e.trippedUntil <= now &&
+            e.flooredAtMs === null && e.speedEwma !== null);
+    };
+    // Stripe count is a connection count, not a distinct-exit count. Keep three
+    // parallel ranges even when only one exit is qualified: two ranges still
+    // delivered CCTV's 1800 stream in 3.6-4.9s, which is marginal for a 4s live
+    // segment, while one connection repeatedly showed 6-10s tails. During
+    // startup, keep whole-segment mode until at least one
+    // exit has delivered a real fast sample; otherwise the unproven startup pool
+    // would scatter half-ranges onto every slow exit and hold assembly hostage.
+    // Set AGENTNET_HLS_STRIPES=1 for an emergency rollback.
+    const usableChinaExits = () => AGG <= 1 || !hasMeasuredChinaExit() ? 1 : AGG;
+    const hlsConcurrency = () => hasMeasuredChinaExit() ? deliveringChinaExits() : 1;
     // Prefetch parallelism = the number of exits ACTUALLY delivering right now
     // (deliveringChinaExits). Each concurrent prefetch is a whole-segment fetch,
     // and the load-aware exit pick (active++ at dispatch) lands each one on a
@@ -1372,7 +1411,9 @@ export function startMultiExitRouter(opts) {
     // degrades to one-at-a-time (full bandwidth per segment, no splitting —
     // several fetches on ONE exit divide it N ways and everything stalls).
     // prefetchAhead=3 matches the 3-segment live window CCTV publishes.
-    const hls = new HlsPrefetcher(fetchViaRegionBuffered, { stripes: AGG, stripesFn: usableChinaExits, stripeChunkBytes: 256 * 1024, concurrencyFn: deliveringChinaExits, prefetchAhead: 3 });
+    const hls = new HlsPrefetcher(fetchViaRegionBuffered, { stripes: AGG, stripesFn: usableChinaExits, stripeChunkBytes: 256 * 1024, concurrencyFn: hlsConcurrency, prefetchAhead: 3 });
+    const hlsVariantFallbacks = new Map();
+    const loggedVariantFallbacks = new Set();
     let lastHlsHits = 0;
     function bumpHlsStats() {
         const s = hls.stats;
@@ -1389,7 +1430,16 @@ export function startMultiExitRouter(opts) {
     // else streams through one exit.
     function serveHlsAware(o) {
         const { fullUrl, host, port, path, target, method, headers, req, res, order, isTls } = o;
-        const u = new URL(fullUrl);
+        // A player may retain a high-bitrate media-playlist URL after the capped
+        // master has been reloaded. Fetch the best allowed variant on its behalf;
+        // the returned media playlist contains the safe segment names, so the next
+        // request naturally moves to the lower bitrate without a page reload.
+        const effectiveFullUrl = hlsVariantFallbacks.get(fullUrl) ?? fullUrl;
+        const u = new URL(effectiveFullUrl);
+        if (effectiveFullUrl !== fullUrl && !loggedVariantFallbacks.has(fullUrl)) {
+            loggedVariantFallbacks.add(fullUrl);
+            log(`  HLS variant fallback ${fullUrl} → ${effectiveFullUrl}`);
+        }
         // The CCTV H5 player fetches segments via XHR/fetch (HLSP2P/DRM), so the
         // browser enforces CORS. The CDN sends Access-Control-Allow-Origin, but our
         // cache-hit and dedup-join serving paths only carried content-type — dropping
@@ -1452,7 +1502,34 @@ export function startMultiExitRouter(opts) {
                         new Promise((_, rej) => { const t = setTimeout(() => rej(new Error("segment total deadline")), SEGMENT_TOTAL_DEADLINE_MS); t.unref?.(); }),
                     ]);
                 fetchPromise
-                    .then((r) => {
+                    .then(async (r) => {
+                    let playlistText = null;
+                    let playlistVariants = [];
+                    if (r.status === 200 && isPlaylist) {
+                        playlistText = r.body.toString("utf8");
+                        playlistVariants = parseM3u8Variants(playlistText, effectiveFullUrl);
+                        if (playlistVariants.length > 0 && HLS_MAX_VARIANT_BPS > 0) {
+                            const originalCount = playlistVariants.length;
+                            for (const [blocked, fallback] of buildM3u8VariantFallbacks(playlistText, effectiveFullUrl, HLS_MAX_VARIANT_BPS)) {
+                                hlsVariantFallbacks.set(blocked, fallback);
+                            }
+                            const capped = capM3u8Variants(playlistText, HLS_MAX_VARIANT_BPS);
+                            if (capped !== playlistText) {
+                                playlistText = capped;
+                                r.body = Buffer.from(capped, "utf8");
+                                playlistVariants = parseM3u8Variants(capped, effectiveFullUrl);
+                                log(`  playlist ${host}: capped ${originalCount} variants to ${playlistVariants.length} at ${(HLS_MAX_VARIANT_BPS / 1e6).toFixed(1)}Mbps`);
+                            }
+                        }
+                        else if (playlistVariants.length === 0) {
+                            const segs = parseM3u8Segments(playlistText, effectiveFullUrl);
+                            const primed = await hls.primePlaylist(effectiveFullUrl, playlistText, 8000, 2);
+                            if (primed > 0)
+                                log(`  playlist ${host}: ${primed} segment(s) cached before first delivery`);
+                            else
+                                log(`  playlist ${host} is MEDIA — ${segs.length} segments, prefetching ahead`);
+                        }
+                    }
                     log(`  MITM ${method} ${host}${(path || "/").slice(0, 80)} → ${r.status} (${r.body.length}B)`);
                     if (r.status >= 400) {
                         const snip = r.body.slice(0, 300).toString("utf8").replace(/\s+/g, " ");
@@ -1467,17 +1544,13 @@ export function startMultiExitRouter(opts) {
                     if (r.status === 200) {
                         const ct = r.headers["content-type"];
                         if (isPlaylist) {
-                            const text = r.body.toString("utf8");
-                            const variants = parseM3u8Variants(text, fullUrl);
+                            const text = playlistText ?? r.body.toString("utf8");
+                            const variants = playlistVariants.length > 0 ? playlistVariants : parseM3u8Variants(text, effectiveFullUrl);
                             if (variants.length > 0) {
                                 const desc = variants.map((v) => `${v.resolution || "?"}@${(v.bandwidth / 1e6).toFixed(1)}Mbps`).join(", ");
                                 log(`  playlist ${host} is MASTER — variants: ${desc}`);
+                                hls.onPlaylist(effectiveFullUrl, text);
                             }
-                            else {
-                                const segs = parseM3u8Segments(text, fullUrl);
-                                log(`  playlist ${host} is MEDIA — ${segs.length} segments, prefetching ahead`);
-                            }
-                            hls.onPlaylist(fullUrl, text);
                         }
                         else {
                             hls.put(fullUrl, r.body, Array.isArray(ct) ? ct[0] : ct);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.193",
+  "version": "0.1.195",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",