@decentnetwork/lan 0.1.194 → 0.1.195

package/dist/cli/commands.js

@@ -2,7 +2,7 @@
  * CLI command handlers
  */
 import { resolve, dirname, join } from "path";
-import { existsSync, mkdirSync, readFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs";
 import { createConnection } from "net";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
@@ -1421,6 +1421,37 @@ export async function cmdProxyTrustCa(args) {
         return;
     }
     if (process.platform === "linux") {
+        // WSL: the browser runs on the WINDOWS side and trusts the WINDOWS cert
+        // store — installing into this distro's Linux store does nothing for it.
+        // certutil.exe is callable from WSL and the per-user ROOT store needs no
+        // admin (Windows pops a confirmation dialog the user must accept).
+        const isWsl = existsSync("/proc/version") &&
+            readFileSync("/proc/version", "utf-8").toLowerCase().includes("microsoft");
+        if (isWsl) {
+            const winCopy = "/mnt/c/Users/Public/agentnet-mitm-ca.pem";
+            const winPath = "C:\\Users\\Public\\agentnet-mitm-ca.pem";
+            console.log("WSL detected — the browser lives on Windows, installing into the Windows user trust store.");
+            try {
+                copyFileSync(caCertPath, winCopy);
+                console.log("A Windows security dialog will pop up — click Yes to trust the CA...");
+                const w = spawnSync("certutil.exe", ["-user", "-addstore", "-f", "ROOT", winPath], { stdio: "inherit" });
+                if (w.status === 0) {
+                    console.log("✓ Windows store updated. Chrome/Edge on Windows pick it up immediately (reload the page).");
+                }
+                else {
+                    console.log("Install failed or dialog declined — in a Windows terminal run:");
+                    console.log(`  certutil -user -addstore -f ROOT "${winPath}"`);
+                }
+            }
+            catch (e) {
+                console.log(`Could not copy the cert to the Windows side (${e.message}). Manually:`);
+                console.log(`  cp "${caCertPath}" ${winCopy}`);
+                console.log(`  certutil.exe -user -addstore -f ROOT "${winPath}"`);
+            }
+            console.log("(Linux-side clients like curl inside WSL would additionally need the system CA store:");
+            console.log(`  sudo cp "${caCertPath}" /usr/local/share/ca-certificates/agentnet-mitm-ca.crt && sudo update-ca-certificates)`);
+            return;
+        }
         console.log("Installing into the system CA store (asks for your sudo password)...");
         const cp = spawnSync("sudo", ["cp", caCertPath, "/usr/local/share/ca-certificates/agentnet-mitm-ca.crt"], { stdio: "inherit" });
         const up = cp.status === 0 ? spawnSync("sudo", ["update-ca-certificates"], { stdio: "inherit" }) : cp;
@@ -1431,8 +1462,20 @@ export async function cmdProxyTrustCa(args) {
         console.log("(package: libnss3-tools). Firefox: Settings → Certificates → Import.");
         return;
     }
-    console.log("Windows: import the cert into 'Trusted Root Certification Authorities':");
-    console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+    if (process.platform === "win32") {
+        console.log("Installing into the Windows user trust store (a security dialog will pop up — click Yes)...");
+        const w = spawnSync("certutil", ["-user", "-addstore", "-f", "ROOT", caCertPath], { stdio: "inherit" });
+        if (w.status === 0) {
+            console.log("✓ Trusted. Chrome/Edge pick it up immediately (reload the page).");
+        }
+        else {
+            console.log("Install failed or dialog declined — run manually (admin terminal for the machine store):");
+            console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+        }
+        return;
+    }
+    console.log(`Unsupported platform ${process.platform} — import this CA into your browser's trust store manually:`);
+    console.log(`  ${caCertPath}`);
 }
 export async function cmdProxyRouter(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();

package/dist/proxy/hls-prefetch.d.ts

@@ -24,6 +24,11 @@ export declare function parseM3u8Variants(playlist: string, baseUrl: string): Hl
  *  metadata and its following URI are removed as one pair. Media playlists are
  *  returned unchanged. */
 export declare function capM3u8Variants(playlist: string, maxBandwidth: number): string;
+/** Map variants above the delivery cap to the fastest variant that remains.
+ * Some players keep polling a previously selected media-playlist URL even after
+ * reloading the capped master playlist. The proxy can use this map to fetch the
+ * safe media playlist while preserving the browser-facing request URL. */
+export declare function buildM3u8VariantFallbacks(playlist: string, baseUrl: string, maxBandwidth: number): Map<string, string>;
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those

package/dist/proxy/hls-prefetch.js

@@ -107,6 +107,27 @@ export function capM3u8Variants(playlist, maxBandwidth) {
     }
     return out.join("\n");
 }
+/** Map variants above the delivery cap to the fastest variant that remains.
+ * Some players keep polling a previously selected media-playlist URL even after
+ * reloading the capped master playlist. The proxy can use this map to fetch the
+ * safe media playlist while preserving the browser-facing request URL. */
+export function buildM3u8VariantFallbacks(playlist, baseUrl, maxBandwidth) {
+    const out = new Map();
+    if (maxBandwidth <= 0)
+        return out;
+    const variants = parseM3u8Variants(playlist, baseUrl).filter((v) => v.url.length > 0);
+    const allowed = variants
+        .filter((v) => v.bandwidth <= maxBandwidth)
+        .sort((a, b) => b.bandwidth - a.bandwidth);
+    const fallback = allowed[0];
+    if (!fallback)
+        return out;
+    for (const variant of variants) {
+        if (variant.bandwidth > maxBandwidth)
+            out.set(variant.url, fallback.url);
+    }
+    return out;
+}
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those

package/dist/proxy/multi-exit-router.js

@@ -21,7 +21,7 @@ import https from "node:https";
 import net from "node:net";
 import tls from "node:tls";
 import { egressConnect } from "./egress.js";
-import { HlsPrefetcher, capM3u8Variants, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments } from "./hls-prefetch.js";
+import { HlsPrefetcher, buildM3u8VariantFallbacks, capM3u8Variants, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments } from "./hls-prefetch.js";
 import { RouteLearner } from "./route-learner.js";
 import { GeoCnClassifier } from "./geo-cn.js";
 import { MitmGateway } from "./mitm-gateway.js";
@@ -162,7 +162,7 @@ const HLS_DELIVERY_BPS = 200_000;
 // Stability-first default for constrained exit pools. Set 0 to expose every
 // origin variant, or 1800000 to restore CCTV 720P when another fast exit joins.
 const HLS_MAX_VARIANT_BPS = process.env.AGENTNET_HLS_MAX_BPS === undefined
-    ? 1_400_000
+    ? 900_000
     : Math.max(0, Number(process.env.AGENTNET_HLS_MAX_BPS));
 export function isUsefulRecoverySample(peakBps, averageBps, minBps = HLS_DELIVERY_BPS) {
     return peakBps >= minBps && averageBps >= minBps;
@@ -1412,6 +1412,8 @@ export function startMultiExitRouter(opts) {
     // several fetches on ONE exit divide it N ways and everything stalls).
     // prefetchAhead=3 matches the 3-segment live window CCTV publishes.
     const hls = new HlsPrefetcher(fetchViaRegionBuffered, { stripes: AGG, stripesFn: usableChinaExits, stripeChunkBytes: 256 * 1024, concurrencyFn: hlsConcurrency, prefetchAhead: 3 });
+    const hlsVariantFallbacks = new Map();
+    const loggedVariantFallbacks = new Set();
     let lastHlsHits = 0;
     function bumpHlsStats() {
         const s = hls.stats;
@@ -1428,7 +1430,16 @@ export function startMultiExitRouter(opts) {
     // else streams through one exit.
     function serveHlsAware(o) {
         const { fullUrl, host, port, path, target, method, headers, req, res, order, isTls } = o;
-        const u = new URL(fullUrl);
+        // A player may retain a high-bitrate media-playlist URL after the capped
+        // master has been reloaded. Fetch the best allowed variant on its behalf;
+        // the returned media playlist contains the safe segment names, so the next
+        // request naturally moves to the lower bitrate without a page reload.
+        const effectiveFullUrl = hlsVariantFallbacks.get(fullUrl) ?? fullUrl;
+        const u = new URL(effectiveFullUrl);
+        if (effectiveFullUrl !== fullUrl && !loggedVariantFallbacks.has(fullUrl)) {
+            loggedVariantFallbacks.add(fullUrl);
+            log(`  HLS variant fallback ${fullUrl} → ${effectiveFullUrl}`);
+        }
         // The CCTV H5 player fetches segments via XHR/fetch (HLSP2P/DRM), so the
         // browser enforces CORS. The CDN sends Access-Control-Allow-Origin, but our
         // cache-hit and dedup-join serving paths only carried content-type — dropping
@@ -1496,20 +1507,23 @@ export function startMultiExitRouter(opts) {
                     let playlistVariants = [];
                     if (r.status === 200 && isPlaylist) {
                         playlistText = r.body.toString("utf8");
-                        playlistVariants = parseM3u8Variants(playlistText, fullUrl);
+                        playlistVariants = parseM3u8Variants(playlistText, effectiveFullUrl);
                         if (playlistVariants.length > 0 && HLS_MAX_VARIANT_BPS > 0) {
                             const originalCount = playlistVariants.length;
+                            for (const [blocked, fallback] of buildM3u8VariantFallbacks(playlistText, effectiveFullUrl, HLS_MAX_VARIANT_BPS)) {
+                                hlsVariantFallbacks.set(blocked, fallback);
+                            }
                             const capped = capM3u8Variants(playlistText, HLS_MAX_VARIANT_BPS);
                             if (capped !== playlistText) {
                                 playlistText = capped;
                                 r.body = Buffer.from(capped, "utf8");
-                                playlistVariants = parseM3u8Variants(capped, fullUrl);
+                                playlistVariants = parseM3u8Variants(capped, effectiveFullUrl);
                                 log(`  playlist ${host}: capped ${originalCount} variants to ${playlistVariants.length} at ${(HLS_MAX_VARIANT_BPS / 1e6).toFixed(1)}Mbps`);
                             }
                         }
                         else if (playlistVariants.length === 0) {
-                            const segs = parseM3u8Segments(playlistText, fullUrl);
-                            const primed = await hls.primePlaylist(fullUrl, playlistText, 8000, 2);
+                            const segs = parseM3u8Segments(playlistText, effectiveFullUrl);
+                            const primed = await hls.primePlaylist(effectiveFullUrl, playlistText, 8000, 2);
                             if (primed > 0)
                                 log(`  playlist ${host}: ${primed} segment(s) cached before first delivery`);
                             else
@@ -1531,11 +1545,11 @@ export function startMultiExitRouter(opts) {
                         const ct = r.headers["content-type"];
                         if (isPlaylist) {
                             const text = playlistText ?? r.body.toString("utf8");
-                            const variants = playlistVariants.length > 0 ? playlistVariants : parseM3u8Variants(text, fullUrl);
+                            const variants = playlistVariants.length > 0 ? playlistVariants : parseM3u8Variants(text, effectiveFullUrl);
                             if (variants.length > 0) {
                                 const desc = variants.map((v) => `${v.resolution || "?"}@${(v.bandwidth / 1e6).toFixed(1)}Mbps`).join(", ");
                                 log(`  playlist ${host} is MASTER — variants: ${desc}`);
-                                hls.onPlaylist(fullUrl, text);
+                                hls.onPlaylist(effectiveFullUrl, text);
                             }
                         }
                         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.194",
+  "version": "0.1.195",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",