@decentnetwork/lan 0.1.194 → 0.1.196

package/dist/cli/commands.js

@@ -2,7 +2,7 @@
  * CLI command handlers
  */
 import { resolve, dirname, join } from "path";
-import { existsSync, mkdirSync, readFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs";
 import { createConnection } from "net";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
@@ -1421,6 +1421,39 @@ export async function cmdProxyTrustCa(args) {
         return;
     }
     if (process.platform === "linux") {
+        // WSL: the browser runs on the WINDOWS side and trusts the WINDOWS cert
+        // store — installing into this distro's Linux store does nothing for it.
+        // certutil -user -addstore ROOT is rejected on modern Windows
+        // (0x80070032 ERROR_NOT_SUPPORTED); PowerShell Import-Certificate into
+        // CurrentUser\Root works without admin (Windows pops a confirmation dialog).
+        const isWsl = existsSync("/proc/version") &&
+            readFileSync("/proc/version", "utf-8").toLowerCase().includes("microsoft");
+        if (isWsl) {
+            const winCopy = "/mnt/c/Users/Public/agentnet-mitm-ca.pem";
+            const winPath = "C:\\Users\\Public\\agentnet-mitm-ca.pem";
+            console.log("WSL detected — the browser lives on Windows, installing into the Windows user trust store.");
+            try {
+                copyFileSync(caCertPath, winCopy);
+                console.log("A Windows security dialog will pop up — click Yes to trust the CA...");
+                const w = spawnSync("powershell.exe", ["-NoProfile", "-Command", `Import-Certificate -FilePath '${winPath}' -CertStoreLocation Cert:\\CurrentUser\\Root`], { stdio: "inherit" });
+                if (w.status === 0) {
+                    console.log("✓ Windows store updated. Chrome/Edge on Windows pick it up immediately (reload the page).");
+                }
+                else {
+                    console.log("Install failed or dialog declined — in a Windows PowerShell run:");
+                    console.log(`  Import-Certificate -FilePath "${winPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
+                    console.log(`(or, in an ADMIN terminal: certutil -addstore -f ROOT "${winPath}")`);
+                }
+            }
+            catch (e) {
+                console.log(`Could not copy the cert to the Windows side (${e.message}). Manually:`);
+                console.log(`  cp "${caCertPath}" ${winCopy}`);
+                console.log(`  then in Windows PowerShell: Import-Certificate -FilePath "${winPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
+            }
+            console.log("(Linux-side clients like curl inside WSL would additionally need the system CA store:");
+            console.log(`  sudo cp "${caCertPath}" /usr/local/share/ca-certificates/agentnet-mitm-ca.crt && sudo update-ca-certificates)`);
+            return;
+        }
         console.log("Installing into the system CA store (asks for your sudo password)...");
         const cp = spawnSync("sudo", ["cp", caCertPath, "/usr/local/share/ca-certificates/agentnet-mitm-ca.crt"], { stdio: "inherit" });
         const up = cp.status === 0 ? spawnSync("sudo", ["update-ca-certificates"], { stdio: "inherit" }) : cp;
@@ -1431,8 +1464,21 @@ export async function cmdProxyTrustCa(args) {
         console.log("(package: libnss3-tools). Firefox: Settings → Certificates → Import.");
         return;
     }
-    console.log("Windows: import the cert into 'Trusted Root Certification Authorities':");
-    console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+    if (process.platform === "win32") {
+        console.log("Installing into the Windows user trust store (a security dialog will pop up — click Yes)...");
+        const w = spawnSync("powershell.exe", ["-NoProfile", "-Command", `Import-Certificate -FilePath '${caCertPath}' -CertStoreLocation Cert:\\CurrentUser\\Root`], { stdio: "inherit" });
+        if (w.status === 0) {
+            console.log("✓ Trusted. Chrome/Edge pick it up immediately (reload the page).");
+        }
+        else {
+            console.log("Install failed or dialog declined — in PowerShell run:");
+            console.log(`  Import-Certificate -FilePath "${caCertPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
+            console.log(`(or, in an ADMIN terminal: certutil -addstore -f ROOT "${caCertPath}")`);
+        }
+        return;
+    }
+    console.log(`Unsupported platform ${process.platform} — import this CA into your browser's trust store manually:`);
+    console.log(`  ${caCertPath}`);
 }
 export async function cmdProxyRouter(args) {
     const dir = args.configDir || ConfigLoader.defaultConfigDir();

package/dist/proxy/hls-prefetch.d.ts

@@ -24,6 +24,11 @@ export declare function parseM3u8Variants(playlist: string, baseUrl: string): Hl
  *  metadata and its following URI are removed as one pair. Media playlists are
  *  returned unchanged. */
 export declare function capM3u8Variants(playlist: string, maxBandwidth: number): string;
+/** Map variants above the delivery cap to the fastest variant that remains.
+ * Some players keep polling a previously selected media-playlist URL even after
+ * reloading the capped master playlist. The proxy can use this map to fetch the
+ * safe media playlist while preserving the browser-facing request URL. */
+export declare function buildM3u8VariantFallbacks(playlist: string, baseUrl: string, maxBandwidth: number): Map<string, string>;
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those

package/dist/proxy/hls-prefetch.js

@@ -107,6 +107,27 @@ export function capM3u8Variants(playlist, maxBandwidth) {
     }
     return out.join("\n");
 }
+/** Map variants above the delivery cap to the fastest variant that remains.
+ * Some players keep polling a previously selected media-playlist URL even after
+ * reloading the capped master playlist. The proxy can use this map to fetch the
+ * safe media playlist while preserving the browser-facing request URL. */
+export function buildM3u8VariantFallbacks(playlist, baseUrl, maxBandwidth) {
+    const out = new Map();
+    if (maxBandwidth <= 0)
+        return out;
+    const variants = parseM3u8Variants(playlist, baseUrl).filter((v) => v.url.length > 0);
+    const allowed = variants
+        .filter((v) => v.bandwidth <= maxBandwidth)
+        .sort((a, b) => b.bandwidth - a.bandwidth);
+    const fallback = allowed[0];
+    if (!fallback)
+        return out;
+    for (const variant of variants) {
+        if (variant.bandwidth > maxBandwidth)
+            out.set(variant.url, fallback.url);
+    }
+    return out;
+}
 /**
  * Extract the media-segment URLs from an m3u8 playlist, resolved against the
  * playlist's own URL. Returns [] for master playlists (variant lists) — those

package/dist/proxy/multi-exit-router.js

@@ -21,7 +21,7 @@ import https from "node:https";
 import net from "node:net";
 import tls from "node:tls";
 import { egressConnect } from "./egress.js";
-import { HlsPrefetcher, capM3u8Variants, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments } from "./hls-prefetch.js";
+import { HlsPrefetcher, buildM3u8VariantFallbacks, capM3u8Variants, looksLikePlaylist, looksLikeSegment, parseM3u8Variants, parseM3u8Segments } from "./hls-prefetch.js";
 import { RouteLearner } from "./route-learner.js";
 import { GeoCnClassifier } from "./geo-cn.js";
 import { MitmGateway } from "./mitm-gateway.js";
@@ -116,6 +116,11 @@ const EXIT_CONNECT_TIMEOUT_MS = 4000;
 // underestimates by ~5x and poisons the ordering. Video segments clear this;
 // API calls and redirects don't (they stay unmeasured = balanced by load).
 const SPEED_MIN_BYTES = 512 * 1024;
+// The 600 kbps CCTV fallback produces ~390-430 KB four-second segments. They
+// are large enough to rank an exit, but never crossed the generic 512 KB gate,
+// leaving every exit "unproven" and rotating foreground playback across slow
+// paths. Keep the generic gate conservative and use this only for HLS bodies.
+const HLS_SPEED_MIN_BYTES = 256 * 1024;
 // We record PEAK 1-second throughput within a transfer, not lifetime average,
 // so slow-start ramp-up doesn't drag the estimate down.
 const SPEED_WINDOW_MS = 1000;
@@ -159,10 +164,15 @@ const NEAR_DEAD_EXIT_BPS = 60_000;
 // threshold admitted 10.86.15.133 on a short peak even though its full CCTV
 // segments averaged only 0.7-1.2 Mbit/s, causing each half-range to take 4-6s.
 const HLS_DELIVERY_BPS = 200_000;
+// Below this speed even the capped 0.9 Mbps stream has no useful headroom. If
+// unproven exits remain, keep exploring them instead of locking startup onto
+// the first measured-but-dead path (observed: 0.3 Mbps 15.133 hid the actually
+// usable 134.139 for the remainder of the router process).
+const HLS_STARTUP_EXPLORE_BPS = 100_000;
 // Stability-first default for constrained exit pools. Set 0 to expose every
 // origin variant, or 1800000 to restore CCTV 720P when another fast exit joins.
 const HLS_MAX_VARIANT_BPS = process.env.AGENTNET_HLS_MAX_BPS === undefined
-    ? 1_400_000
+    ? 900_000
     : Math.max(0, Number(process.env.AGENTNET_HLS_MAX_BPS));
 export function isUsefulRecoverySample(peakBps, averageBps, minBps = HLS_DELIVERY_BPS) {
     return peakBps >= minBps && averageBps >= minBps;
@@ -235,12 +245,14 @@ function floorExit(exit) {
 /** Feed one tunnel's rate meter into the exit's speed EWMA (peak-window based).
  *  Only transfers past SPEED_MIN_BYTES count — smaller ones never reveal path
  *  capacity on a high-RTT link. */
-function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS) {
+function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS, minBytes = SPEED_MIN_BYTES, useWholeAverage = false) {
     exit.bytesDown += meter.total;
-    if (meter.total < SPEED_MIN_BYTES)
+    if (meter.total < minBytes)
         return;
-    const bps = meter.peakBps(durMs);
-    if (bps <= 0)
+    const peakBps = meter.peakBps(durMs);
+    const averageBps = durMs > 0 ? (meter.total / durMs) * 1000 : 0;
+    const bps = useWholeAverage ? Math.min(peakBps, averageBps) : peakBps;
+    if (bps <= 0 || averageBps <= 0)
         return;
     if (exit.flooredAtMs !== null) {
         // FLOOR_BPS is a penalty, not a real historical sample. A qualifying probe
@@ -251,8 +263,7 @@ function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS) {
         // also prove whole-segment average throughput. A probe observed at a 0.9
         // Mbit/s peak but only 0.6 Mbit/s average caused six-way prefetch/hedge
         // congestion when it rejoined a 1.8 Mbit/s stream.
-        const averageBps = durMs > 0 ? (meter.total / durMs) * 1000 : 0;
-        if (isUsefulRecoverySample(bps, averageBps, recoveryMinBps)) {
+        if (isUsefulRecoverySample(peakBps, averageBps, recoveryMinBps)) {
             exit.speedEwma = bps;
             exit.flooredAtMs = null;
         }
@@ -287,10 +298,14 @@ export function selectHlsPrimaryPool(pool) {
     // still safer than falling back to every unproven/degraded exit. This is the
     // adaptive-bitrate path: the master playlist is capped separately, while
     // foreground delivery stays on the least-bad known tier.
+    const unproven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma === null);
     const measured = pool.filter((e) => e.flooredAtMs === null && e.speedEwma !== null);
-    if (measured.length > 0)
+    if (measured.length > 0) {
+        const bestMeasured = Math.max(...measured.map((e) => e.speedEwma ?? 0));
+        if (bestMeasured < HLS_STARTUP_EXPLORE_BPS && unproven.length > 0)
+            return unproven;
         return fastestTier(measured);
-    const unproven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma === null);
+    }
     return unproven.length > 0 ? unproven : pool;
 }
 /** Dynamic prefetch concurrency follows only the foreground-safe pool. */
@@ -1315,7 +1330,7 @@ export function startMultiExitRouter(opts) {
                             nextExit(`empty ${status}`);
                             return;
                         }
-                        sampleSpeed(exit, meter, durMs, HLS_DELIVERY_BPS);
+                        sampleSpeed(exit, meter, durMs, HLS_DELIVERY_BPS, HLS_SPEED_MIN_BYTES, true);
                         if (label) {
                             const kb = (body.length / 1024).toFixed(0);
                             const mbps = durMs > 0 ? ((body.length * 8) / durMs / 1000).toFixed(1) : "?";
@@ -1391,7 +1406,7 @@ export function startMultiExitRouter(opts) {
             return false;
         const now = Date.now();
         return exits.some((e) => e.region === fallbackRegion && e.trippedUntil <= now &&
-            e.flooredAtMs === null && e.speedEwma !== null);
+            e.flooredAtMs === null && e.speedEwma !== null && e.speedEwma >= HLS_STARTUP_EXPLORE_BPS);
     };
     // Stripe count is a connection count, not a distinct-exit count. Keep three
     // parallel ranges even when only one exit is qualified: two ranges still
@@ -1412,6 +1427,8 @@ export function startMultiExitRouter(opts) {
     // several fetches on ONE exit divide it N ways and everything stalls).
     // prefetchAhead=3 matches the 3-segment live window CCTV publishes.
     const hls = new HlsPrefetcher(fetchViaRegionBuffered, { stripes: AGG, stripesFn: usableChinaExits, stripeChunkBytes: 256 * 1024, concurrencyFn: hlsConcurrency, prefetchAhead: 3 });
+    const hlsVariantFallbacks = new Map();
+    const loggedVariantFallbacks = new Set();
     let lastHlsHits = 0;
     function bumpHlsStats() {
         const s = hls.stats;
@@ -1428,7 +1445,16 @@ export function startMultiExitRouter(opts) {
     // else streams through one exit.
     function serveHlsAware(o) {
         const { fullUrl, host, port, path, target, method, headers, req, res, order, isTls } = o;
-        const u = new URL(fullUrl);
+        // A player may retain a high-bitrate media-playlist URL after the capped
+        // master has been reloaded. Fetch the best allowed variant on its behalf;
+        // the returned media playlist contains the safe segment names, so the next
+        // request naturally moves to the lower bitrate without a page reload.
+        const effectiveFullUrl = hlsVariantFallbacks.get(fullUrl) ?? fullUrl;
+        const u = new URL(effectiveFullUrl);
+        if (effectiveFullUrl !== fullUrl && !loggedVariantFallbacks.has(fullUrl)) {
+            loggedVariantFallbacks.add(fullUrl);
+            log(`  HLS variant fallback ${fullUrl} → ${effectiveFullUrl}`);
+        }
         // The CCTV H5 player fetches segments via XHR/fetch (HLSP2P/DRM), so the
         // browser enforces CORS. The CDN sends Access-Control-Allow-Origin, but our
         // cache-hit and dedup-join serving paths only carried content-type — dropping
@@ -1496,20 +1522,23 @@ export function startMultiExitRouter(opts) {
                     let playlistVariants = [];
                     if (r.status === 200 && isPlaylist) {
                         playlistText = r.body.toString("utf8");
-                        playlistVariants = parseM3u8Variants(playlistText, fullUrl);
+                        playlistVariants = parseM3u8Variants(playlistText, effectiveFullUrl);
                         if (playlistVariants.length > 0 && HLS_MAX_VARIANT_BPS > 0) {
                             const originalCount = playlistVariants.length;
+                            for (const [blocked, fallback] of buildM3u8VariantFallbacks(playlistText, effectiveFullUrl, HLS_MAX_VARIANT_BPS)) {
+                                hlsVariantFallbacks.set(blocked, fallback);
+                            }
                             const capped = capM3u8Variants(playlistText, HLS_MAX_VARIANT_BPS);
                             if (capped !== playlistText) {
                                 playlistText = capped;
                                 r.body = Buffer.from(capped, "utf8");
-                                playlistVariants = parseM3u8Variants(capped, fullUrl);
+                                playlistVariants = parseM3u8Variants(capped, effectiveFullUrl);
                                 log(`  playlist ${host}: capped ${originalCount} variants to ${playlistVariants.length} at ${(HLS_MAX_VARIANT_BPS / 1e6).toFixed(1)}Mbps`);
                             }
                         }
                         else if (playlistVariants.length === 0) {
-                            const segs = parseM3u8Segments(playlistText, fullUrl);
-                            const primed = await hls.primePlaylist(fullUrl, playlistText, 8000, 2);
+                            const segs = parseM3u8Segments(playlistText, effectiveFullUrl);
+                            const primed = await hls.primePlaylist(effectiveFullUrl, playlistText, 8000, 2);
                             if (primed > 0)
                                 log(`  playlist ${host}: ${primed} segment(s) cached before first delivery`);
                             else
@@ -1531,11 +1560,11 @@ export function startMultiExitRouter(opts) {
                         const ct = r.headers["content-type"];
                         if (isPlaylist) {
                             const text = playlistText ?? r.body.toString("utf8");
-                            const variants = playlistVariants.length > 0 ? playlistVariants : parseM3u8Variants(text, fullUrl);
+                            const variants = playlistVariants.length > 0 ? playlistVariants : parseM3u8Variants(text, effectiveFullUrl);
                             if (variants.length > 0) {
                                 const desc = variants.map((v) => `${v.resolution || "?"}@${(v.bandwidth / 1e6).toFixed(1)}Mbps`).join(", ");
                                 log(`  playlist ${host} is MASTER — variants: ${desc}`);
-                                hls.onPlaylist(fullUrl, text);
+                                hls.onPlaylist(effectiveFullUrl, text);
                             }
                         }
                         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.194",
+  "version": "0.1.196",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",