@decentnetwork/lan 0.1.250 → 0.1.252

package/dist/cli/commands.d.ts

@@ -1,6 +1,7 @@
 /**
  * CLI command handlers
  */
+import type { BootstrapNode } from "../types.js";
 /**
  * Initialize ~/.agentnet directory and config
  */
@@ -516,3 +517,46 @@ export declare function cmdServiceRestart(args: {
 export declare function cmdRestart(args: {
     configDir?: string;
 }): Promise<void>;
+/**
+ * Parse the published feed's node array into our BootstrapNode shape.
+ *
+ * The feed uses the native SDK's field names (`ipv4`, string `port`,
+ * `publicKey`); we use `host`/number `port`/`pk`. Both spellings are accepted
+ * so the same command works against a hand-written file too.
+ *
+ * Invalid entries are skipped and reported rather than aborting the whole
+ * update — one bad row in the feed shouldn't block adopting the other 14.
+ */
+declare function parseFeedNodes(raw: unknown, rejected: string[]): BootstrapNode[];
+/** Test seam — the feed parser is a trust boundary and gets pinned by
+ *  test/unit/bootstrap-feed.test.ts without going over the network. */
+export declare const __testParseFeedNodes: typeof parseFeedNodes;
+/**
+ * `agentnet bootstrap update` — pull the published bootstrap list and adopt any
+ * node the installed build doesn't ship.
+ *
+ * Why this exists: `npm install -g @decentnetwork/lan@latest` updates the
+ * BUILT-IN defaults (config.yaml's own `bootstrapNodes:` block is ignored at
+ * load time — see ConfigLoader.normalizeConfig), so upgrading does refresh
+ * bootstraps. But that only ever gives you the list as of the last release. When
+ * we stand up a bootstrap mid-cycle, every node has to wait for an npm publish.
+ * This command closes that gap: fetch the live feed, append what's new to
+ * `carrier.extraBootstrapNodes`, and the next daemon start picks it up.
+ */
+export declare function cmdBootstrapUpdate(args: {
+    configDir?: string;
+    url?: string;
+    dryRun?: boolean;
+    clear?: boolean;
+}): Promise<void>;
+/**
+ * `agentnet bootstrap show` — print the list the daemon will actually use,
+ * flagging which entries are shipped defaults vs. adopted from a feed.
+ *
+ * Worth its own command because the `bootstrapNodes:` block sitting in
+ * config.yaml is NOT what gets used — it's overwritten by the shipped defaults
+ * on every load, so reading the file gives the wrong answer.
+ */
+export declare function cmdBootstrapShow(args: {
+    configDir?: string;
+}): Promise<void>;

package/dist/cli/commands.js

@@ -6,7 +6,7 @@ import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs";
 import { createConnection } from "net";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
-import { ConfigLoader, DEFAULT_DORAS, DEFAULT_EXITS } from "../config/loader.js";
+import { ConfigLoader, DEFAULT_BOOTSTRAP_NODES, DEFAULT_DORAS, DEFAULT_EXITS, mergeBootstrapNodes, } from "../config/loader.js";
 import { ipcSocketPath, ipcSocketSupportsFsExistenceCheck, } from "../daemon/ipc.js";
 import { DaemonServer } from "../daemon/server.js";
 import { Ipam } from "../ipam/ipam.js";
@@ -2543,3 +2543,208 @@ export async function cmdRestart(args) {
     console.log(`Daemon scheduled for self-restart. New process will exec: ${(data.argv || []).join(" ")}`);
     console.log("Allow ~5s for the daemon to come back up. Verify with 'agentnet diag'.");
 }
+// ---------------------------------------------------------------------------
+// bootstrap feed
+// ---------------------------------------------------------------------------
+/**
+ * Where the fleet's live bootstrap list is published. Same file the Beagle web
+ * app reads, so app and daemon converge on one source of truth instead of
+ * drifting apart (2026-07-25: the app's list had lens/gojipower/gfax while the
+ * npm defaults didn't, and vice versa).
+ */
+const DEFAULT_BOOTSTRAP_FEED_URL = "https://beagle.chat/assets/bgservers.json";
+/** Carrier public keys are base58-encoded 32-byte keys → 43-44 chars. */
+const BASE58_KEY_RE = /^[1-9A-HJ-NP-Za-km-z]{40,50}$/;
+/** IPv4 literal or hostname. Deliberately strict: this is remote input that
+ *  becomes network config, so anything with a scheme, path, port suffix,
+ *  whitespace or credentials is rejected rather than normalized. */
+const HOST_RE = /^[A-Za-z0-9]([A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$/;
+/** Upper bound on how many nodes a feed may install. A bootstrap list is a
+ *  dozen or so entries; anything near this is a malformed or hostile feed. */
+const MAX_FEED_NODES = 64;
+/**
+ * Parse the published feed's node array into our BootstrapNode shape.
+ *
+ * The feed uses the native SDK's field names (`ipv4`, string `port`,
+ * `publicKey`); we use `host`/number `port`/`pk`. Both spellings are accepted
+ * so the same command works against a hand-written file too.
+ *
+ * Invalid entries are skipped and reported rather than aborting the whole
+ * update — one bad row in the feed shouldn't block adopting the other 14.
+ */
+function parseFeedNodes(raw, rejected) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const entry of raw.slice(0, MAX_FEED_NODES)) {
+        if (!entry || typeof entry !== "object") {
+            rejected.push(`${JSON.stringify(entry)} (not an object)`);
+            continue;
+        }
+        const e = entry;
+        const host = typeof e.ipv4 === "string" ? e.ipv4 : typeof e.host === "string" ? e.host : "";
+        const portRaw = e.port;
+        const port = typeof portRaw === "number"
+            ? portRaw
+            : typeof portRaw === "string"
+                ? Number.parseInt(portRaw, 10)
+                : NaN;
+        const pk = typeof e.publicKey === "string" ? e.publicKey : typeof e.pk === "string" ? e.pk : "";
+        if (!HOST_RE.test(host)) {
+            rejected.push(`${host || "(no host)"} — bad host`);
+            continue;
+        }
+        if (!Number.isInteger(port) || port < 1 || port > 65535) {
+            rejected.push(`${host} — bad port ${String(portRaw)}`);
+            continue;
+        }
+        if (!BASE58_KEY_RE.test(pk)) {
+            rejected.push(`${host}:${port} — bad public key`);
+            continue;
+        }
+        out.push({ host, port, pk });
+    }
+    if (Array.isArray(raw) && raw.length > MAX_FEED_NODES) {
+        rejected.push(`(${raw.length - MAX_FEED_NODES} further entries ignored — feed over ${MAX_FEED_NODES} nodes)`);
+    }
+    return out;
+}
+/** Test seam — the feed parser is a trust boundary and gets pinned by
+ *  test/unit/bootstrap-feed.test.ts without going over the network. */
+export const __testParseFeedNodes = parseFeedNodes;
+/**
+ * `agentnet bootstrap update` — pull the published bootstrap list and adopt any
+ * node the installed build doesn't ship.
+ *
+ * Why this exists: `npm install -g @decentnetwork/lan@latest` updates the
+ * BUILT-IN defaults (config.yaml's own `bootstrapNodes:` block is ignored at
+ * load time — see ConfigLoader.normalizeConfig), so upgrading does refresh
+ * bootstraps. But that only ever gives you the list as of the last release. When
+ * we stand up a bootstrap mid-cycle, every node has to wait for an npm publish.
+ * This command closes that gap: fetch the live feed, append what's new to
+ * `carrier.extraBootstrapNodes`, and the next daemon start picks it up.
+ */
+export async function cmdBootstrapUpdate(args) {
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    const configPath = resolve(dir, "config.yaml");
+    const config = await ConfigLoader.load(configPath);
+    if (args.clear) {
+        const had = config.carrier.extraBootstrapNodes?.length ?? 0;
+        delete config.carrier.extraBootstrapNodes;
+        delete config.carrier.bootstrapSource;
+        config.carrier.bootstrapNodes = [...DEFAULT_BOOTSTRAP_NODES];
+        await ConfigLoader.save(config, configPath);
+        console.log(`Cleared ${had} extra bootstrap node(s); back to the ${DEFAULT_BOOTSTRAP_NODES.length} shipped defaults.`);
+        console.log("Takes effect on the next daemon start ('agentnet restart').");
+        return;
+    }
+    const url = args.url || DEFAULT_BOOTSTRAP_FEED_URL;
+    // Remote config over plain HTTP is trivially rewritable in transit, and the
+    // payload here decides which nodes we hand our DHT traffic to.
+    if (!url.startsWith("https://")) {
+        console.error(`Refusing to fetch bootstrap config over a non-HTTPS URL: ${url}`);
+        process.exit(1);
+    }
+    console.log(`Fetching ${url} ...`);
+    let payload;
+    try {
+        const res = await fetch(url, {
+            signal: AbortSignal.timeout(20_000),
+            headers: { accept: "application/json" },
+        });
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status} ${res.statusText}`);
+        payload = await res.json();
+    }
+    catch (error) {
+        // A feed that's down or unreachable is an ordinary outcome (offline node,
+        // GFW, publish in flight) — report it and leave the config alone. The
+        // daemon keeps running on the shipped defaults either way.
+        console.error(`Could not fetch the bootstrap feed (${url}): ${error instanceof Error ? error.message : String(error)}`);
+        console.error("Config unchanged — the built-in defaults still apply.");
+        process.exit(1);
+    }
+    const feed = payload;
+    const rejected = [];
+    const fetched = parseFeedNodes(feed?.bootstrapNodes, rejected);
+    if (fetched.length === 0) {
+        console.error(`Feed had no usable bootstrapNodes (${rejected.length} rejected).`);
+        for (const bad of rejected.slice(0, 10))
+            console.error(`  ! ${bad}`);
+        console.error("Config unchanged.");
+        process.exit(1);
+    }
+    const shipped = new Set(DEFAULT_BOOTSTRAP_NODES.map((n) => `${n.host}:${n.port}`));
+    const extras = fetched.filter((n) => !shipped.has(`${n.host}:${n.port}`));
+    const previous = config.carrier.extraBootstrapNodes ?? [];
+    const previousKeys = new Set(previous.map((n) => `${n.host}:${n.port}`));
+    const added = extras.filter((n) => !previousKeys.has(`${n.host}:${n.port}`));
+    const dropped = previous.filter((n) => !extras.some((e) => e.host === n.host && e.port === n.port));
+    console.log(`Feed: ${fetched.length} node(s) — ${fetched.length - extras.length} already shipped in this build, ${extras.length} extra.`);
+    for (const node of extras) {
+        const mark = previousKeys.has(`${node.host}:${node.port}`) ? " " : "+";
+        console.log(`  ${mark} ${node.host}:${node.port}  ${node.pk}`);
+    }
+    for (const node of dropped) {
+        console.log(`  - ${node.host}:${node.port}  ${node.pk}  (no longer in feed)`);
+    }
+    for (const bad of rejected) {
+        console.log(`  ! skipped ${bad}`);
+    }
+    if (args.dryRun) {
+        console.log("\n--dry-run: config not written.");
+        return;
+    }
+    if (added.length === 0 && dropped.length === 0) {
+        console.log("\nAlready up to date — config unchanged.");
+        return;
+    }
+    if (extras.length > 0) {
+        config.carrier.extraBootstrapNodes = extras;
+        config.carrier.bootstrapSource = { url, fetchedAt: new Date().toISOString() };
+    }
+    else {
+        delete config.carrier.extraBootstrapNodes;
+        delete config.carrier.bootstrapSource;
+    }
+    config.carrier.bootstrapNodes = mergeBootstrapNodes([...DEFAULT_BOOTSTRAP_NODES], config.carrier.extraBootstrapNodes);
+    await ConfigLoader.save(config, configPath);
+    console.log(`\nWrote ${configPath}: ${added.length} added, ${dropped.length} removed → ${config.carrier.bootstrapNodes.length} bootstrap node(s) total.`);
+    console.log("Takes effect on the next daemon start — 'agentnet restart' (no sudo needed).");
+}
+/**
+ * `agentnet bootstrap show` — print the list the daemon will actually use,
+ * flagging which entries are shipped defaults vs. adopted from a feed.
+ *
+ * Worth its own command because the `bootstrapNodes:` block sitting in
+ * config.yaml is NOT what gets used — it's overwritten by the shipped defaults
+ * on every load, so reading the file gives the wrong answer.
+ */
+export async function cmdBootstrapShow(args) {
+    const dir = args.configDir || ConfigLoader.defaultConfigDir();
+    const config = await ConfigLoader.load(resolve(dir, "config.yaml"));
+    const extraKeys = new Set((config.carrier.extraBootstrapNodes ?? []).map((n) => `${n.host}:${n.port}`));
+    console.log(`Effective bootstrap nodes (${config.carrier.bootstrapNodes.length}):`);
+    for (const node of config.carrier.bootstrapNodes) {
+        const origin = extraKeys.has(`${node.host}:${node.port}`) ? "feed" : "shipped";
+        console.log(`  ${node.host}:${node.port}`.padEnd(28) + `${node.pk}  [${origin}]`);
+    }
+    if (config.carrier.bootstrapSource) {
+        console.log(`\nFeed: ${config.carrier.bootstrapSource.url} (fetched ${config.carrier.bootstrapSource.fetchedAt})`);
+    }
+    else {
+        console.log(`\nNo feed adopted — run 'agentnet bootstrap update' to pull ${DEFAULT_BOOTSTRAP_FEED_URL}.`);
+    }
+    // The live daemon may predate the current config; say so rather than letting
+    // the operator assume the printed list is what's running.
+    const pid = daemonPid(config);
+    if (pid !== null) {
+        const res = await ipcCall(config, { op: "diag" });
+        if (res.ok) {
+            const live = res.data?.dht?.bootstrapsConfigured;
+            if (typeof live === "number" && live !== config.carrier.bootstrapNodes.length) {
+                console.log(`\nNOTE: the running daemon (pid ${pid}) has ${live} bootstrap(s) loaded, not ${config.carrier.bootstrapNodes.length}. Restart it to apply: 'agentnet restart'.`);
+            }
+        }
+    }
+}

package/dist/cli/index.js

@@ -10,7 +10,7 @@ import { hideBin } from "yargs/helpers";
 // Belt-and-braces — also raise it here in case the CLI is run directly
 // (e.g. `node dist/cli/index.js` rather than via dist/index.js).
 EventEmitter.defaultMaxListeners = 100;
-import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
+import { cmdInit, cmdIdentityShow, cmdPeersList, cmdIpamAssign, cmdGrant, cmdRevoke, cmdResolve, cmdStatus, cmdUp, cmdAuditLog, cmdFriendRequest, cmdFriendAccept, cmdFriendsList, cmdFriendsPending, cmdFriendsAccept, cmdFriendsAutoAccept, cmdFriendsReject, cmdProxyEnable, cmdProxyDisable, cmdProxyStatus, cmdProxyWho, cmdProxyAccess, cmdProxyAllowHost, cmdProxyRevokeHost, cmdProxyListHosts, cmdProxyWhitelist, cmdProxyFileWhitelist, cmdProxyBusyMbps, cmdProxyUse, cmdProxyRouter, cmdProxyTrustCa, cmdDoraEnable, cmdDoraDisable, cmdDoraStatus, cmdDoraAutofriend, cmdBootstrapShow, cmdBootstrapUpdate, cmdDiag, cmdDoctor, cmdDnsInstall, cmdDnsHosts, cmdServiceInstall, cmdRestart, cmdServiceStatus, cmdServiceRestart, cmdUi, cmdConsole, cmdFileSend, cmdChatSend, cmdChatHistory, cmdFriendRemove, cmdFriendAlias, } from "./commands.js";
 async function main() {
     await yargs(hideBin(process.argv))
         .scriptName("agentnet")
@@ -103,6 +103,40 @@ async function main() {
     })
         .command("doctor", "Self-check: diagnoses config/daemon/dora/peer problems and prints the fix for each", (y) => y.option("config-dir", { type: "string" }), async (argv) => {
         await cmdDoctor({ configDir: argv["config-dir"] });
+    })
+        // An npm upgrade refreshes the BUILT-IN bootstrap defaults, but only to
+        // whatever the release shipped with. When a bootstrap is deployed
+        // mid-cycle, this pulls it from the published feed so nodes don't have to
+        // wait for the next publish.
+        .command("bootstrap", "Show or refresh the Carrier bootstrap node list", (y) => y
+        .command("show", "Print the bootstrap nodes the daemon will actually use", (yy) => yy.option("config-dir", { type: "string" }), async (argv) => {
+        await cmdBootstrapShow({ configDir: argv["config-dir"] });
+    })
+        .command("update", "Fetch the published server list and adopt any bootstrap this build doesn't ship", (yy) => yy
+        .option("url", {
+        type: "string",
+        describe: "Feed URL (must be https). Defaults to the published beagle.chat list",
+    })
+        .option("dry-run", {
+        type: "boolean",
+        default: false,
+        describe: "Show what would change without writing the config",
+    })
+        .option("clear", {
+        type: "boolean",
+        default: false,
+        describe: "Drop all feed-adopted nodes and go back to the shipped defaults",
+    })
+        .option("config-dir", { type: "string" }), async (argv) => {
+        await cmdBootstrapUpdate({
+            url: argv.url,
+            dryRun: argv["dry-run"],
+            clear: argv.clear,
+            configDir: argv["config-dir"],
+        });
+    })
+        .demandCommand(1, "Specify a bootstrap subcommand: show | update"), () => {
+        // parent handler — never invoked because demandCommand above
     })
         .command("dns", "Manage OS-side DNS resolver wiring for the .decent zone", (y) => y
         .command("install", "Route .decent queries to the local daemon (writes /etc/resolver on macOS or resolvectl on Linux)", (yy) => yy

package/dist/config/loader.d.ts

@@ -1,4 +1,20 @@
-import type { DecentAgentNetConfig } from "../types.js";
+import type { BootstrapNode, DecentAgentNetConfig } from "../types.js";
+export declare const DEFAULT_BOOTSTRAP_NODES: {
+    host: string;
+    port: number;
+    pk: string;
+}[];
+/**
+ * Shipped defaults first, then any node the operator (or `agentnet bootstrap
+ * update`) added that we don't already ship, deduped on host:port.
+ *
+ * Extras are APPENDED, never interleaved: the ordering of
+ * DEFAULT_BOOTSTRAP_NODES is deliberate (US relays first so a US↔US session
+ * doesn't land on a China relay — see the comment above it), and a remote feed
+ * has no idea where this node is. So a fetched list can add reachability, but
+ * it can't rearrange the relay-landing preference we tuned.
+ */
+export declare function mergeBootstrapNodes(base: BootstrapNode[], extra?: BootstrapNode[]): BootstrapNode[];
 /**
  * Public dora servers baked into `agentnet init` so an operator can join
  * the canonical Decent AgentNet without first hunting down a registry

package/dist/config/loader.js

@@ -9,43 +9,90 @@ const DEFAULT_CONFIG_FILE = resolve(DEFAULT_CONFIG_DIR, "config.yaml");
 // Mirrored from peer SDK's legacy-bootstraps.mjs
 // 45.207.220.155 omitted — observed timing out repeatedly during testing,
 // causing relay#2 to flap which knocks the friend connection offline.
-// Ordered with US relays first so a US↔US session (the common case)
-// doesn't land on a China relay just because it was first in the list.
-// Observed in the wild: both Vultr (US public IP) and a Mac (US
-// residential) connected to 47.100.103.201 (Alibaba Cloud Shanghai)
-// as their sole TCP relay — every packet between them transited
-// China, ~600ms RTT, and net_crypto handshakes often dropped because
-// the path was lossy. Reordering puts AWS US-East/US-West first so
-// the SDK's "connect to top-N relays" path naturally picks closer
-// nodes. The China + Singapore nodes stay in the list as fallback for
-// peers actually in those regions.
-const DEFAULT_BOOTSTRAP_NODES = [
+//
+// ORDER IS LOAD-BEARING, and more than the old comment implied. The SDK's TCP
+// relay pool takes the FIRST 3 entries positionally (TcpRelayPool.start(),
+// DECENT_TCP_MAX_RELAYS default 3) — not a random sample, not by health. So
+// every node running the same release dials the SAME three hosts, and those
+// three are effectively the fleet's rendezvous set. Two consequences:
+//
+//   1. A host in the top 3 that doesn't accept TCP burns one of only three
+//      relay slots on every node in the world. That is exactly what happened
+//      when gojipower was added at position 2 in 0.1.249: air-wli went from 6
+//      connected relays to 2 after picking up the new list, because gojipower's
+//      ufw has no rule for 33445 (verified 2026-07-25 — `ufw status` shows the
+//      port absent while ela-bootstrapd LISTENs locally: alive != serving).
+//   2. A China relay in the top 3 puts a US<->US session on a China path.
+//      Observed in the wild: a Vultr US box and a US residential Mac both
+//      landed on 47.100.103.201 (Alibaba Shanghai) as their sole relay —
+//      ~600ms RTT and lossy enough to drop net_crypto handshakes.
+//
+// So: positions 1-3 are US-reachable hosts whose TCP relay port is CONFIRMED
+// open; everything after is DHT-bootstrap breadth and the reserve pool that
+// the dynamic-relay-add path draws from when a friend advertises one.
+// TCP-relay reachability below was measured from a US vantage point on
+// 2026-07-25. "TCP filtered" does NOT mean dead — several still answer UDP
+// DHT, and CN-side reachability was not re-tested (see docs/BOOTSTRAP-FLEET.md
+// on why a single vantage point must not be used to prune).
+export const DEFAULT_BOOTSTRAP_NODES = [
+    // --- Rendezvous set: the three every node dials. TCP verified open. ---
+    // US-East — the historical workhorse, and the relay mac-dev has held
+    // continuously through every incident this month.
+    { host: "13.58.208.50", port: 33445, pk: "89vny8MrKdDKs7Uta9RdVmspPjnRMdwMmaiEW27pZ7gh" },
     // lens (Vultr US) — OUR OWN ela-bootstrapd, same box as the express relay.
     // It was in the iOS app's bootstrap list but missing here, which is a big
     // part of why natives could always bootstrap while JS peers struggled
     // (2026-07-25 discovery-outage postmortem: docs/BOOTSTRAP-FLEET.md).
     { host: "144.202.113.167", port: 33445, pk: "EfT4YMq6qfHdDsCiBCgsEmA78E2NxVYVKVUS9bD6w9GH" },
-    // gojipower (Vultr US) — ours, deployed 2026-07-25, systemd + rcvbuf tuned.
-    { host: "149.28.98.141", port: 33445, pk: "81PPfuEyzSovgxymxr2ifiCWXdB5CGaiofx5MrxnhYV7" },
+    // US-East.
+    { host: "18.216.6.197", port: 33445, pk: "H8sqhRrQuJZ6iLtP2wanxt4LzdNrN2NNFnpPdq1uJ9n2" },
+    // --- Reserve pool. TCP verified open; reached via the dynamic-relay-add
+    // path when a friend advertises them, and used for DHT bootstrap breadth.
+    { host: "52.57.248.163", port: 33445, pk: "CfJLve8FNQPQJ9xYQ8oEVkPxeAPCN7iSdhnYFkWmWgLn" }, // eu-central
+    { host: "35.179.41.220", port: 33445, pk: "6u2vKadPa9wqDf531QaZy7FJN3c7Wzntm7dKXxXqvyNB" }, // eu-west
+    { host: "52.63.19.190", port: 33445, pk: "EeNenbyS4sx3qtu82esT1V1NMe9dZib5LyQmYGM6fboK" }, // ap-southeast
+    // CN — ours. Nearest for peers actually in China; deliberately NOT in the
+    // top 3 so US<->US traffic can't land here as its only relay.
+    { host: "47.100.103.201", port: 33445, pk: "CX1XH419p4xJ5SV4KvDxBeKYSRdMJW9QpdWJY8owUxHd" }, // sh
     // gfax (Aliyun CN) — ours, running since 2026-07-02, moved under systemd
-    // 2026-07-25 (identity preserved). Nearest bootstrap for CN peers.
+    // 2026-07-25 (identity preserved).
     { host: "139.129.193.117", port: 33445, pk: "67UQhssARwMky1YgFA2oDGZ1RiQYQmS6JqWFHxtopKq5" },
-    // US-East — closest for typical North-American peers.
-    { host: "13.58.208.50", port: 33445, pk: "89vny8MrKdDKs7Uta9RdVmspPjnRMdwMmaiEW27pZ7gh" },
+    // --- TCP filtered from the US as of 2026-07-25. Kept for UDP DHT bootstrap
+    // and in case they serve other regions; must not occupy a relay slot.
+    // gojipower (Vultr US) — ours, deployed 2026-07-25. Demote until its ufw
+    // allows 33445; promote back to the rendezvous set once verified.
+    { host: "149.28.98.141", port: 33445, pk: "81PPfuEyzSovgxymxr2ifiCWXdB5CGaiofx5MrxnhYV7" },
     { host: "18.216.102.47", port: 33445, pk: "G5z8MqiNDFTadFUPfMdYsYtkUDbX5mNCMVHMZtsCnFeb" },
-    { host: "18.216.6.197", port: 33445, pk: "H8sqhRrQuJZ6iLtP2wanxt4LzdNrN2NNFnpPdq1uJ9n2" },
-    // US-West.
     { host: "54.193.141.205", port: 33445, pk: "7TfZWZNV8vnBxxWzJXuvKgX2QyKkLpg2oXx3LQ5tg8LW" },
-    // Unknown / global.
     { host: "154.64.235.176", port: 33445, pk: "GdNtV2N74fZnLjhH7NhQ18nGdxb1k8jRM9dQaK7WnxmL" },
-    // Asia-Pacific (Singapore + China). Kept as fallback so peers
-    // actually in CN/SG can use a nearby relay. Peers in the US should
-    // not be hitting these for normal traffic.
     { host: "52.74.215.181", port: 33445, pk: "Xv6d34WaUw9bPn7YihzVAFw7D2igbQJZ3jwmzzfYVFV" },
-    { host: "47.100.103.201", port: 33445, pk: "CX1XH419p4xJ5SV4KvDxBeKYSRdMJW9QpdWJY8owUxHd" },
     { host: "52.83.171.135", port: 443, pk: "5tuHgK1Q4CYf4K5PutsEPK5E3Z7cbtEBdx7LwmdzqXHL" },
     { host: "52.83.191.228", port: 33445, pk: "3khtxZo89SBScAMaHhTvD68pPHiKxgZT6hTCSZZVgNEm" },
 ];
+/**
+ * Shipped defaults first, then any node the operator (or `agentnet bootstrap
+ * update`) added that we don't already ship, deduped on host:port.
+ *
+ * Extras are APPENDED, never interleaved: the ordering of
+ * DEFAULT_BOOTSTRAP_NODES is deliberate (US relays first so a US↔US session
+ * doesn't land on a China relay — see the comment above it), and a remote feed
+ * has no idea where this node is. So a fetched list can add reachability, but
+ * it can't rearrange the relay-landing preference we tuned.
+ */
+export function mergeBootstrapNodes(base, extra) {
+    if (!extra?.length)
+        return base;
+    const seen = new Set(base.map((n) => `${n.host}:${n.port}`));
+    const merged = [...base];
+    for (const node of extra) {
+        const key = `${node.host}:${node.port}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        merged.push(node);
+    }
+    return merged;
+}
 const DEFAULT_EXPRESS_NODES = [
     // lens stays PRIMARY for backward-compat: older clients (peer < 0.1.25)
     // only know lens and pull from the first relay, so replies must land on
@@ -282,7 +329,11 @@ export class ConfigLoader {
         const dir = dirname(path);
         // Create directory if it doesn't exist
         mkdirSync(dir, { recursive: true });
-        const content = yaml.dump(config, { lineWidth: -1 });
+        // noRefs: config.yaml is hand-edited. Any object that appears twice in the
+        // tree (e.g. a node in both `bootstrapNodes` and `extraBootstrapNodes`)
+        // would otherwise be written as a YAML anchor/alias — valid, but it turns
+        // the list into `- *ref_0` and silently couples two entries under editing.
+        const content = yaml.dump(config, { lineWidth: -1, noRefs: true });
         const fs = await import("fs/promises");
         await fs.writeFile(path, content, "utf-8");
     }
@@ -304,7 +355,19 @@ export class ConfigLoader {
                 // pins a US peer to a China relay forever even after we
                 // reorder defaults, and every install upgrade keeps the bad
                 // first-relay landing pattern.
-                bootstrapNodes: defaults.carrier.bootstrapNodes,
+                //
+                // `extraBootstrapNodes` is the escape hatch: nodes we don't ship yet
+                // (published feed, or a private deployment) get APPENDED to the
+                // defaults rather than replacing them, so an operator can adopt a
+                // freshly-deployed bootstrap without an npm release and still track
+                // our ordering. `agentnet bootstrap update` writes that field.
+                bootstrapNodes: mergeBootstrapNodes(defaults.carrier.bootstrapNodes, config.carrier?.extraBootstrapNodes),
+                ...(config.carrier?.extraBootstrapNodes?.length
+                    ? { extraBootstrapNodes: config.carrier.extraBootstrapNodes }
+                    : {}),
+                ...(config.carrier?.bootstrapSource
+                    ? { bootstrapSource: config.carrier.bootstrapSource }
+                    : {}),
                 expressNodes: config.carrier?.expressNodes || defaults.carrier.expressNodes,
             },
             network: {

package/dist/console/console.js

@@ -665,32 +665,56 @@ import yaml from "js-yaml";
 var DEFAULT_CONFIG_DIR = resolve(homedir2(), ".agentnet");
 var DEFAULT_CONFIG_FILE = resolve(DEFAULT_CONFIG_DIR, "config.yaml");
 var DEFAULT_BOOTSTRAP_NODES = [
+  // --- Rendezvous set: the three every node dials. TCP verified open. ---
+  // US-East — the historical workhorse, and the relay mac-dev has held
+  // continuously through every incident this month.
+  { host: "13.58.208.50", port: 33445, pk: "89vny8MrKdDKs7Uta9RdVmspPjnRMdwMmaiEW27pZ7gh" },
   // lens (Vultr US) — OUR OWN ela-bootstrapd, same box as the express relay.
   // It was in the iOS app's bootstrap list but missing here, which is a big
   // part of why natives could always bootstrap while JS peers struggled
   // (2026-07-25 discovery-outage postmortem: docs/BOOTSTRAP-FLEET.md).
   { host: "144.202.113.167", port: 33445, pk: "EfT4YMq6qfHdDsCiBCgsEmA78E2NxVYVKVUS9bD6w9GH" },
-  // gojipower (Vultr US) — ours, deployed 2026-07-25, systemd + rcvbuf tuned.
-  { host: "149.28.98.141", port: 33445, pk: "81PPfuEyzSovgxymxr2ifiCWXdB5CGaiofx5MrxnhYV7" },
+  // US-East.
+  { host: "18.216.6.197", port: 33445, pk: "H8sqhRrQuJZ6iLtP2wanxt4LzdNrN2NNFnpPdq1uJ9n2" },
+  // --- Reserve pool. TCP verified open; reached via the dynamic-relay-add
+  // path when a friend advertises them, and used for DHT bootstrap breadth.
+  { host: "52.57.248.163", port: 33445, pk: "CfJLve8FNQPQJ9xYQ8oEVkPxeAPCN7iSdhnYFkWmWgLn" },
+  // eu-central
+  { host: "35.179.41.220", port: 33445, pk: "6u2vKadPa9wqDf531QaZy7FJN3c7Wzntm7dKXxXqvyNB" },
+  // eu-west
+  { host: "52.63.19.190", port: 33445, pk: "EeNenbyS4sx3qtu82esT1V1NMe9dZib5LyQmYGM6fboK" },
+  // ap-southeast
+  // CN — ours. Nearest for peers actually in China; deliberately NOT in the
+  // top 3 so US<->US traffic can't land here as its only relay.
+  { host: "47.100.103.201", port: 33445, pk: "CX1XH419p4xJ5SV4KvDxBeKYSRdMJW9QpdWJY8owUxHd" },
+  // sh
   // gfax (Aliyun CN) — ours, running since 2026-07-02, moved under systemd
-  // 2026-07-25 (identity preserved). Nearest bootstrap for CN peers.
+  // 2026-07-25 (identity preserved).
   { host: "139.129.193.117", port: 33445, pk: "67UQhssARwMky1YgFA2oDGZ1RiQYQmS6JqWFHxtopKq5" },
-  // US-East — closest for typical North-American peers.
-  { host: "13.58.208.50", port: 33445, pk: "89vny8MrKdDKs7Uta9RdVmspPjnRMdwMmaiEW27pZ7gh" },
+  // --- TCP filtered from the US as of 2026-07-25. Kept for UDP DHT bootstrap
+  // and in case they serve other regions; must not occupy a relay slot.
+  // gojipower (Vultr US) — ours, deployed 2026-07-25. Demote until its ufw
+  // allows 33445; promote back to the rendezvous set once verified.
+  { host: "149.28.98.141", port: 33445, pk: "81PPfuEyzSovgxymxr2ifiCWXdB5CGaiofx5MrxnhYV7" },
   { host: "18.216.102.47", port: 33445, pk: "G5z8MqiNDFTadFUPfMdYsYtkUDbX5mNCMVHMZtsCnFeb" },
-  { host: "18.216.6.197", port: 33445, pk: "H8sqhRrQuJZ6iLtP2wanxt4LzdNrN2NNFnpPdq1uJ9n2" },
-  // US-West.
   { host: "54.193.141.205", port: 33445, pk: "7TfZWZNV8vnBxxWzJXuvKgX2QyKkLpg2oXx3LQ5tg8LW" },
-  // Unknown / global.
   { host: "154.64.235.176", port: 33445, pk: "GdNtV2N74fZnLjhH7NhQ18nGdxb1k8jRM9dQaK7WnxmL" },
-  // Asia-Pacific (Singapore + China). Kept as fallback so peers
-  // actually in CN/SG can use a nearby relay. Peers in the US should
-  // not be hitting these for normal traffic.
   { host: "52.74.215.181", port: 33445, pk: "Xv6d34WaUw9bPn7YihzVAFw7D2igbQJZ3jwmzzfYVFV" },
-  { host: "47.100.103.201", port: 33445, pk: "CX1XH419p4xJ5SV4KvDxBeKYSRdMJW9QpdWJY8owUxHd" },
   { host: "52.83.171.135", port: 443, pk: "5tuHgK1Q4CYf4K5PutsEPK5E3Z7cbtEBdx7LwmdzqXHL" },
   { host: "52.83.191.228", port: 33445, pk: "3khtxZo89SBScAMaHhTvD68pPHiKxgZT6hTCSZZVgNEm" }
 ];
+function mergeBootstrapNodes(base, extra) {
+  if (!extra?.length) return base;
+  const seen = new Set(base.map((n) => `${n.host}:${n.port}`));
+  const merged = [...base];
+  for (const node of extra) {
+    const key = `${node.host}:${node.port}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    merged.push(node);
+  }
+  return merged;
+}
 var DEFAULT_EXPRESS_NODES = [
   // lens stays PRIMARY for backward-compat: older clients (peer < 0.1.25)
   // only know lens and pull from the first relay, so replies must land on
@@ -885,7 +909,7 @@ var ConfigLoader = class {
     const path = filePath || DEFAULT_CONFIG_FILE;
     const dir = dirname(path);
     mkdirSync(dir, { recursive: true });
-    const content = yaml.dump(config, { lineWidth: -1 });
+    const content = yaml.dump(config, { lineWidth: -1, noRefs: true });
     const fs = await import("fs/promises");
     await fs.writeFile(path, content, "utf-8");
   }
@@ -907,7 +931,18 @@ var ConfigLoader = class {
         // pins a US peer to a China relay forever even after we
         // reorder defaults, and every install upgrade keeps the bad
         // first-relay landing pattern.
-        bootstrapNodes: defaults.carrier.bootstrapNodes,
+        //
+        // `extraBootstrapNodes` is the escape hatch: nodes we don't ship yet
+        // (published feed, or a private deployment) get APPENDED to the
+        // defaults rather than replacing them, so an operator can adopt a
+        // freshly-deployed bootstrap without an npm release and still track
+        // our ordering. `agentnet bootstrap update` writes that field.
+        bootstrapNodes: mergeBootstrapNodes(
+          defaults.carrier.bootstrapNodes,
+          config.carrier?.extraBootstrapNodes
+        ),
+        ...config.carrier?.extraBootstrapNodes?.length ? { extraBootstrapNodes: config.carrier.extraBootstrapNodes } : {},
+        ...config.carrier?.bootstrapSource ? { bootstrapSource: config.carrier.bootstrapSource } : {},
         expressNodes: config.carrier?.expressNodes || defaults.carrier.expressNodes
       },
       network: {

package/dist/types.d.ts

@@ -119,6 +119,18 @@ export interface CarrierConfig {
     dataDir: string;
     bootstrapNodes: BootstrapNode[];
     expressNodes?: BootstrapNode[];
+    /** Bootstraps the shipped build doesn't know about, appended to the
+     *  built-in defaults at load time. `agentnet bootstrap update` fills this
+     *  from the published server feed so a node can pick up newly-deployed
+     *  bootstraps without waiting for an npm release. Written by that command;
+     *  hand-editing is fine too. */
+    extraBootstrapNodes?: BootstrapNode[];
+    /** Provenance for `extraBootstrapNodes` — which feed it came from and when.
+     *  Purely informational (printed by `agentnet bootstrap show`). */
+    bootstrapSource?: {
+        url: string;
+        fetchedAt: string;
+    };
 }
 export interface NetworkConfig {
     interface: string;

package/dist/ui/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.250";
+window.__DK_UI_VERSION="0.1.252";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.250",
+  "version": "0.1.252",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",