@decentnetwork/lan 0.1.195 → 0.1.196

package/dist/cli/commands.js

@@ -1423,8 +1423,9 @@ export async function cmdProxyTrustCa(args) {
     if (process.platform === "linux") {
         // WSL: the browser runs on the WINDOWS side and trusts the WINDOWS cert
         // store — installing into this distro's Linux store does nothing for it.
-        // certutil.exe is callable from WSL and the per-user ROOT store needs no
-        // admin (Windows pops a confirmation dialog the user must accept).
+        // certutil -user -addstore ROOT is rejected on modern Windows
+        // (0x80070032 ERROR_NOT_SUPPORTED); PowerShell Import-Certificate into
+        // CurrentUser\Root works without admin (Windows pops a confirmation dialog).
         const isWsl = existsSync("/proc/version") &&
             readFileSync("/proc/version", "utf-8").toLowerCase().includes("microsoft");
         if (isWsl) {
@@ -1434,19 +1435,20 @@ export async function cmdProxyTrustCa(args) {
             try {
                 copyFileSync(caCertPath, winCopy);
                 console.log("A Windows security dialog will pop up — click Yes to trust the CA...");
-                const w = spawnSync("certutil.exe", ["-user", "-addstore", "-f", "ROOT", winPath], { stdio: "inherit" });
+                const w = spawnSync("powershell.exe", ["-NoProfile", "-Command", `Import-Certificate -FilePath '${winPath}' -CertStoreLocation Cert:\\CurrentUser\\Root`], { stdio: "inherit" });
                 if (w.status === 0) {
                     console.log("✓ Windows store updated. Chrome/Edge on Windows pick it up immediately (reload the page).");
                 }
                 else {
-                    console.log("Install failed or dialog declined — in a Windows terminal run:");
-                    console.log(`  certutil -user -addstore -f ROOT "${winPath}"`);
+                    console.log("Install failed or dialog declined — in a Windows PowerShell run:");
+                    console.log(`  Import-Certificate -FilePath "${winPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
+                    console.log(`(or, in an ADMIN terminal: certutil -addstore -f ROOT "${winPath}")`);
                 }
             }
             catch (e) {
                 console.log(`Could not copy the cert to the Windows side (${e.message}). Manually:`);
                 console.log(`  cp "${caCertPath}" ${winCopy}`);
-                console.log(`  certutil.exe -user -addstore -f ROOT "${winPath}"`);
+                console.log(`  then in Windows PowerShell: Import-Certificate -FilePath "${winPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
             }
             console.log("(Linux-side clients like curl inside WSL would additionally need the system CA store:");
             console.log(`  sudo cp "${caCertPath}" /usr/local/share/ca-certificates/agentnet-mitm-ca.crt && sudo update-ca-certificates)`);
@@ -1464,13 +1466,14 @@ export async function cmdProxyTrustCa(args) {
     }
     if (process.platform === "win32") {
         console.log("Installing into the Windows user trust store (a security dialog will pop up — click Yes)...");
-        const w = spawnSync("certutil", ["-user", "-addstore", "-f", "ROOT", caCertPath], { stdio: "inherit" });
+        const w = spawnSync("powershell.exe", ["-NoProfile", "-Command", `Import-Certificate -FilePath '${caCertPath}' -CertStoreLocation Cert:\\CurrentUser\\Root`], { stdio: "inherit" });
         if (w.status === 0) {
             console.log("✓ Trusted. Chrome/Edge pick it up immediately (reload the page).");
         }
         else {
-            console.log("Install failed or dialog declined — run manually (admin terminal for the machine store):");
-            console.log(`  certutil -addstore -f ROOT "${caCertPath}"`);
+            console.log("Install failed or dialog declined — in PowerShell run:");
+            console.log(`  Import-Certificate -FilePath "${caCertPath}" -CertStoreLocation Cert:\\CurrentUser\\Root`);
+            console.log(`(or, in an ADMIN terminal: certutil -addstore -f ROOT "${caCertPath}")`);
         }
         return;
     }

package/dist/proxy/multi-exit-router.js

@@ -116,6 +116,11 @@ const EXIT_CONNECT_TIMEOUT_MS = 4000;
 // underestimates by ~5x and poisons the ordering. Video segments clear this;
 // API calls and redirects don't (they stay unmeasured = balanced by load).
 const SPEED_MIN_BYTES = 512 * 1024;
+// The 600 kbps CCTV fallback produces ~390-430 KB four-second segments. They
+// are large enough to rank an exit, but never crossed the generic 512 KB gate,
+// leaving every exit "unproven" and rotating foreground playback across slow
+// paths. Keep the generic gate conservative and use this only for HLS bodies.
+const HLS_SPEED_MIN_BYTES = 256 * 1024;
 // We record PEAK 1-second throughput within a transfer, not lifetime average,
 // so slow-start ramp-up doesn't drag the estimate down.
 const SPEED_WINDOW_MS = 1000;
@@ -159,6 +164,11 @@ const NEAR_DEAD_EXIT_BPS = 60_000;
 // threshold admitted 10.86.15.133 on a short peak even though its full CCTV
 // segments averaged only 0.7-1.2 Mbit/s, causing each half-range to take 4-6s.
 const HLS_DELIVERY_BPS = 200_000;
+// Below this speed even the capped 0.9 Mbps stream has no useful headroom. If
+// unproven exits remain, keep exploring them instead of locking startup onto
+// the first measured-but-dead path (observed: 0.3 Mbps 15.133 hid the actually
+// usable 134.139 for the remainder of the router process).
+const HLS_STARTUP_EXPLORE_BPS = 100_000;
 // Stability-first default for constrained exit pools. Set 0 to expose every
 // origin variant, or 1800000 to restore CCTV 720P when another fast exit joins.
 const HLS_MAX_VARIANT_BPS = process.env.AGENTNET_HLS_MAX_BPS === undefined
@@ -235,12 +245,14 @@ function floorExit(exit) {
 /** Feed one tunnel's rate meter into the exit's speed EWMA (peak-window based).
  *  Only transfers past SPEED_MIN_BYTES count — smaller ones never reveal path
  *  capacity on a high-RTT link. */
-function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS) {
+function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS, minBytes = SPEED_MIN_BYTES, useWholeAverage = false) {
     exit.bytesDown += meter.total;
-    if (meter.total < SPEED_MIN_BYTES)
+    if (meter.total < minBytes)
         return;
-    const bps = meter.peakBps(durMs);
-    if (bps <= 0)
+    const peakBps = meter.peakBps(durMs);
+    const averageBps = durMs > 0 ? (meter.total / durMs) * 1000 : 0;
+    const bps = useWholeAverage ? Math.min(peakBps, averageBps) : peakBps;
+    if (bps <= 0 || averageBps <= 0)
         return;
     if (exit.flooredAtMs !== null) {
         // FLOOR_BPS is a penalty, not a real historical sample. A qualifying probe
@@ -251,8 +263,7 @@ function sampleSpeed(exit, meter, durMs, recoveryMinBps = NEAR_DEAD_EXIT_BPS) {
         // also prove whole-segment average throughput. A probe observed at a 0.9
         // Mbit/s peak but only 0.6 Mbit/s average caused six-way prefetch/hedge
         // congestion when it rejoined a 1.8 Mbit/s stream.
-        const averageBps = durMs > 0 ? (meter.total / durMs) * 1000 : 0;
-        if (isUsefulRecoverySample(bps, averageBps, recoveryMinBps)) {
+        if (isUsefulRecoverySample(peakBps, averageBps, recoveryMinBps)) {
             exit.speedEwma = bps;
             exit.flooredAtMs = null;
         }
@@ -287,10 +298,14 @@ export function selectHlsPrimaryPool(pool) {
     // still safer than falling back to every unproven/degraded exit. This is the
     // adaptive-bitrate path: the master playlist is capped separately, while
     // foreground delivery stays on the least-bad known tier.
+    const unproven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma === null);
     const measured = pool.filter((e) => e.flooredAtMs === null && e.speedEwma !== null);
-    if (measured.length > 0)
+    if (measured.length > 0) {
+        const bestMeasured = Math.max(...measured.map((e) => e.speedEwma ?? 0));
+        if (bestMeasured < HLS_STARTUP_EXPLORE_BPS && unproven.length > 0)
+            return unproven;
         return fastestTier(measured);
-    const unproven = pool.filter((e) => e.flooredAtMs === null && e.speedEwma === null);
+    }
     return unproven.length > 0 ? unproven : pool;
 }
 /** Dynamic prefetch concurrency follows only the foreground-safe pool. */
@@ -1315,7 +1330,7 @@ export function startMultiExitRouter(opts) {
                             nextExit(`empty ${status}`);
                             return;
                         }
-                        sampleSpeed(exit, meter, durMs, HLS_DELIVERY_BPS);
+                        sampleSpeed(exit, meter, durMs, HLS_DELIVERY_BPS, HLS_SPEED_MIN_BYTES, true);
                         if (label) {
                             const kb = (body.length / 1024).toFixed(0);
                             const mbps = durMs > 0 ? ((body.length * 8) / durMs / 1000).toFixed(1) : "?";
@@ -1391,7 +1406,7 @@ export function startMultiExitRouter(opts) {
             return false;
         const now = Date.now();
         return exits.some((e) => e.region === fallbackRegion && e.trippedUntil <= now &&
-            e.flooredAtMs === null && e.speedEwma !== null);
+            e.flooredAtMs === null && e.speedEwma !== null && e.speedEwma >= HLS_STARTUP_EXPLORE_BPS);
     };
     // Stripe count is a connection count, not a distinct-exit count. Keep three
     // parallel ranges even when only one exit is qualified: two ranges still

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.195",
+  "version": "0.1.196",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",