@decentnetwork/lan 0.1.284 → 0.1.286

package/dist/carrier/offline-call.js

@@ -6,10 +6,16 @@ export const DEFAULT_OFFLINE_CONFIG = {
     appName: "Beagle",
     socketUrl: "https://io.beagle.chat",
     socketUrls: ["https://io.beagle.chat"],
+    // Measured 2026-08-28: pushapi.beagle.chat returns 502 on every path (its
+    // vhost is down), www.callpass.cn is unreachable, and tokyo.fi.chat:3004 is
+    // the WRONG PORT — that service listens on 443. All three dead at once, so
+    // an offline call could not wake a phone, while the phone apps kept working
+    // because bgservers.json points them at tokyo.fi.chat on 443.
+    // Verified: POST https://tokyo.fi.chat/push-api/push-message with this
+    // client's exact query-string shape returns 200.
     pushEndpoints: [
-        "https://pushapi.beagle.chat/push-api/push-message",
-        "https://www.callpass.cn/push-api/push-message",
-        "https://tokyo.fi.chat:3004/push-api/push-message"
+        "https://tokyo.fi.chat/push-api/push-message",
+        "https://pushapi.beagle.chat/push-api/push-message"
     ]
 };
 /**

package/dist/daemon/friend-meta.d.ts

@@ -14,6 +14,18 @@ export interface FriendMeta {
     pinned?: boolean;
     /** ts of the newest message the user has seen — drives unread counts. */
     lastReadTs?: number;
+    /**
+     * When we first had PROOF this friendship is mutual — something arrived from
+     * them, or a send to them landed. Both need a two-way session, which needs
+     * them to have accepted.
+     *
+     * The SDK clears its own "requested" state on a dhtpk_update, which it reads
+     * as acceptance. It is not: that packet says the peer exists and is
+     * reachable, nothing about a human pressing Accept. Trusting it showed a
+     * peer as online before they had accepted, while every message to them
+     * queued — because there is no session to someone who has not added you.
+     */
+    confirmedAt?: number;
     addedAt: number;
 }
 export declare class FriendMetaStore {
@@ -29,6 +41,9 @@ export declare class FriendMetaStore {
     ensure(userid: string): FriendMeta;
     setAlias(userid: string, alias: string | undefined): void;
     markRead(userid: string, ts?: number): void;
+    /** Record proof the friendship is mutual. Idempotent; first proof wins. */
+    markConfirmed(userid: string, ts?: number): boolean;
+    isConfirmed(userid: string): boolean;
     setPinned(userid: string, pinned: boolean): void;
     remove(userid: string): void;
     private scheduleSave;

package/dist/daemon/friend-meta.js

@@ -59,6 +59,18 @@ export class FriendMetaStore {
             this.scheduleSave();
         }
     }
+    /** Record proof the friendship is mutual. Idempotent; first proof wins. */
+    markConfirmed(userid, ts = Date.now()) {
+        const m = this.ensure(userid);
+        if (m.confirmedAt)
+            return false;
+        m.confirmedAt = ts;
+        this.scheduleSave();
+        return true;
+    }
+    isConfirmed(userid) {
+        return !!this.byUserid.get(userid)?.confirmedAt;
+    }
     setPinned(userid, pinned) {
         const m = this.ensure(userid);
         m.pinned = pinned || undefined;

package/dist/daemon/server.d.ts

@@ -135,6 +135,17 @@ export declare class DaemonServer {
      *  text and queued files, oldest first. Called when a friend reconnects.
      *  Stops early if the link drops again, leaving the remainder queued for the
      *  next reconnect (true store-and-forward). Re-entrancy-guarded per peer. */
+    /**
+     * One-time backfill so upgrading does not re-open settled friendships.
+     *
+     * requestedAt stays on a friend record forever, so the new "unproven"
+     * rule would mark every friend we ever ASKED — i.e. most of them — as
+     * "requested" again until the next message. An inbound message is the same
+     * proof the live rule uses: they could only have sent it over a session that
+     * required them to accept us. So anyone we have already heard from is
+     * confirmed at startup, and only genuinely unaccepted requests stay pending.
+     */
+    private backfillConfirmedFriends;
     private flushOutbox;
     /** Per-peer timestamp of the last self-heal friend-request re-send, so
      *  the watchdog escalates at most once per SELF_HEAL_REFRIEND_MS. */

package/dist/daemon/server.js

@@ -385,6 +385,7 @@ export class DaemonServer {
             // On-disk chat + friend-metadata stores (survive restarts; back the UI).
             this.messageStore = new MessageStore(resolve(this.configDir, "messages.json"));
             this.friendMeta = new FriendMetaStore(resolve(this.configDir, "friends-meta.json"));
+            this.backfillConfirmedFriends();
             this.outboxDir = resolve(this.configDir, "outbox");
             this.reconcileOutboxOnStart();
             // Start IPC as soon as the peer is up. The CLI uses it to drive
@@ -458,6 +459,7 @@ export class DaemonServer {
                     void (async () => {
                         try {
                             await this.peerManager.sendText(userid, text);
+                            this.friendMeta?.markConfirmed(userid); // it landed: mutual
                             this.messageStore?.setStatus(userid, msg.id, undefined); // delivered
                         }
                         catch (e) {
@@ -491,6 +493,11 @@ export class DaemonServer {
                         // The build-default nickname is useless (every node sends it) —
                         // treat it as no-name so the UI falls back to alias/userid.
                         const realName = f.name && f.name !== "@decentnetwork/peer" ? f.name : undefined;
+                        // A peer WE asked stays "requested" until proof arrives, whatever
+                        // the SDK's own status says. Peers we did not ask (inbound
+                        // requests we accepted) have no requestedAt, so they are
+                        // unaffected — as is every friend already confirmed.
+                        const unproven = !!f.requestedAt && !this.friendMeta?.isConfirmed(uid);
                         return {
                             userid: uid,
                             // Full Carrier address (pubkey+nospam+checksum) — the form a NEW
@@ -499,7 +506,7 @@ export class DaemonServer {
                             address: f.address,
                             alias: meta?.alias,
                             name: meta?.alias || realName || uid,
-                            status: f.status,
+                            status: unproven ? "requested" : f.status,
                             lastSeen: f.lastSeen,
                             pinned: meta?.pinned ?? false,
                             lastMessage: lastMsg ? { dir: lastMsg.dir, text: lastMsg.text, ts: lastMsg.ts } : undefined,
@@ -1146,6 +1153,7 @@ export class DaemonServer {
             };
             // Chat: log incoming Carrier text messages (packet 64) for the UI.
             this.peerManager.on("message", (pubkey, text, via) => {
+                this.friendMeta?.markConfirmed(pubkey); // they reached us: mutual
                 this.logChat(pubkey, "in", text, via);
             });
             // Presence: push to IPC subscribers so the TUI/UI reflects online/offline
@@ -1212,6 +1220,7 @@ export class DaemonServer {
                 }
             });
             this.peerManager.on("file-complete", (p) => {
+                this.friendMeta?.markConfirmed(p.friendId);
                 if (p.sending || !p.data) {
                     if (p.sending) {
                         // The receiver has ACKed the whole file — now it's truly delivered.
@@ -1634,6 +1643,32 @@ export class DaemonServer {
      *  text and queued files, oldest first. Called when a friend reconnects.
      *  Stops early if the link drops again, leaving the remainder queued for the
      *  next reconnect (true store-and-forward). Re-entrancy-guarded per peer. */
+    /**
+     * One-time backfill so upgrading does not re-open settled friendships.
+     *
+     * requestedAt stays on a friend record forever, so the new "unproven"
+     * rule would mark every friend we ever ASKED — i.e. most of them — as
+     * "requested" again until the next message. An inbound message is the same
+     * proof the live rule uses: they could only have sent it over a session that
+     * required them to accept us. So anyone we have already heard from is
+     * confirmed at startup, and only genuinely unaccepted requests stay pending.
+     */
+    backfillConfirmedFriends() {
+        if (!this.messageStore || !this.friendMeta)
+            return;
+        let marked = 0;
+        const all = this.messageStore.history();
+        for (const [peer, msgs] of Object.entries(all)) {
+            if (this.friendMeta.isConfirmed(peer))
+                continue;
+            if (msgs.some((m) => m.dir === "in")) {
+                this.friendMeta.markConfirmed(peer);
+                marked++;
+            }
+        }
+        if (marked)
+            this.logger.info(`Confirmed ${marked} existing friend(s) from chat history`);
+    }
     async flushOutbox(userid) {
         if (this.flushingOutbox.has(userid))
             return;

package/dist/dora/dora-integration.d.ts

@@ -141,8 +141,15 @@ export declare class DoraIntegration {
      * ipam.yaml — that file remains operator-managed. Dora is treated as
      * a live overlay that's refreshed on every restart.
      *
-     * Conflict policy: dora wins. If ipam.yaml had a peer with a stale IP,
-     * the dora record overwrites it (assignPeer dedupes by name + carrierId).
+     * Conflict policy: dora wins over ipam.yaml, but NOT over an address a real
+     * packet just proved. A peer that re-allocates shows up on the wire before
+     * dora's roster catches up, and letting the roster win there made the two
+     * writers fight: the router learned the live address from inbound traffic,
+     * the next refresh put the stale one back, and the mapping oscillated. From
+     * the outside that is a ping at ~60% loss — a few replies, then a run of
+     * timeouts, then replies again. Measured between mac-dev and air-wli
+     * 2026-08-30, with the flip visible in the log as alternating
+     * "IPAM updated from inbound" and "Assigned peer" lines for one peer.
      */
     private mergeRosterIntoIpam;
     /**

package/dist/dora/dora-integration.js

@@ -14,6 +14,10 @@
 import { DoraClient, AllRegistriesUnavailableError } from "@decentnetwork/dora";
 import { DEFAULT_DORAS } from "../config/loader.js";
 import { Logger } from "../utils/logger.js";
+/** How long an address confirmed by an inbound packet outranks the dora
+ *  roster. Long enough to cover a roster that lags a re-allocation, short
+ *  enough that a peer which genuinely moved is picked up from dora again. */
+const LEARNED_IP_TRUST_MS = 10 * 60_000;
 export class DoraIntegration {
     opts;
     client;
@@ -458,8 +462,15 @@ export class DoraIntegration {
      * ipam.yaml — that file remains operator-managed. Dora is treated as
      * a live overlay that's refreshed on every restart.
      *
-     * Conflict policy: dora wins. If ipam.yaml had a peer with a stale IP,
-     * the dora record overwrites it (assignPeer dedupes by name + carrierId).
+     * Conflict policy: dora wins over ipam.yaml, but NOT over an address a real
+     * packet just proved. A peer that re-allocates shows up on the wire before
+     * dora's roster catches up, and letting the roster win there made the two
+     * writers fight: the router learned the live address from inbound traffic,
+     * the next refresh put the stale one back, and the mapping oscillated. From
+     * the outside that is a ping at ~60% loss — a few replies, then a run of
+     * timeouts, then replies again. Measured between mac-dev and air-wli
+     * 2026-08-30, with the flip visible in the log as alternating
+     * "IPAM updated from inbound" and "Assigned peer" lines for one peer.
      */
     mergeRosterIntoIpam(roster, myUserid) {
         let added = 0;
@@ -471,6 +482,17 @@ export class DoraIntegration {
             if (!existing) {
                 added += 1;
             }
+            else if (existing.virtualIp !== entry.virtualIp &&
+                existing.learnedAt !== undefined &&
+                Date.now() - existing.learnedAt < LEARNED_IP_TRUST_MS) {
+                // Traffic from this peer confirmed a different address, recently.
+                // Believe the wire and leave the entry alone; the roster will agree
+                // once dora catches up with the re-allocation.
+                this.logger.info(`roster says ${entry.name} is ${entry.virtualIp}, but traffic proved ` +
+                    `${existing.virtualIp} — keeping the learned address`);
+                this.maybeFriend(entry);
+                continue;
+            }
             else if (existing.virtualIp !== entry.virtualIp ||
                 existing.name !== entry.name) {
                 updated += 1;

package/dist/router/packet-router.js

@@ -244,6 +244,9 @@ export class PacketRouter extends EventEmitter {
             carrierId: srcPubkey,
             virtualIp: srcIp,
             services: existing?.services ?? [],
+            // Stamped so a stale dora roster cannot overwrite what a real packet
+            // just proved. See IpamRecord.learnedAt.
+            learnedAt: Date.now(),
         });
         this.logger.info(existing
             ? `IPAM updated from inbound: ${name} ${existing.virtualIp} -> ${srcIp}`

package/dist/types.d.ts

@@ -42,6 +42,14 @@ export interface IpamRecord {
     virtualIp: string;
     services: Service[];
     expiresAt?: number;
+    /** When this address was last confirmed by an inbound packet FROM this peer.
+     *
+     *  A packet is proof of the address a peer is using right now; the dora
+     *  roster is a cache that can lag a re-allocation. Without this the roster
+     *  overwrote the learned address on every refresh and the router flipped
+     *  between the two — visible as ~60% packet loss on a ping that otherwise
+     *  worked. */
+    learnedAt?: number;
 }
 export interface IpamConfig {
     namespace: string;

package/dist/ui/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.284";
+window.__DK_UI_VERSION="0.1.286";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.284",
+  "version": "0.1.286",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",