@decentnetwork/lan 0.1.298 → 0.1.300

package/dist/daemon/message-store.d.ts

@@ -14,10 +14,19 @@ export interface ChatMessage {
     ts: number;
     /** Stable per-message id (ts + per-process sequence) for UI keys / dedup. */
     id: string;
-    /** Outgoing-text delivery state. "queued" means the peer was offline when the
-     *  user hit send, so the daemon stored it and will deliver it (in order) the
-     *  moment the friend reconnects. Cleared once actually sent. */
-    status?: "queued" | "sent" | "failed";
+    /** Outgoing-text delivery state. "sending" = the background delivery attempt
+     *  is still running (chat-send returns before the network is consulted).
+     *  "queued" = that attempt gave up, or the peer was offline when the user hit
+     *  send; the daemon delivers it (in order) the moment the friend reconnects.
+     *  Cleared once actually sent.
+     *
+     *  The two states must stay distinct: chat-send used to store the message as
+     *  "queued" while its own send was in flight, and the reconnect flush sends
+     *  everything "queued". sendText brings the session up first when it has to,
+     *  and the session coming up IS the reconnect event — so the flush sent the
+     *  message, then chat-send sent it again, 10-20 ms apart. Every friend of a
+     *  daemon saw those messages twice. */
+    status?: "sending" | "queued" | "sent" | "failed";
     /** How this message traversed the network, for the UI to distinguish at a
      *  glance (different colors). "online" = live net_crypto session (direct/relay);
      *  "offline" = express store-and-forward (the friend or we were offline). Lets
@@ -52,11 +61,11 @@ export declare class MessageStore {
     /** Append a message and schedule a flush. Returns the stored message.
      *  Pass `status: "queued"` for an outgoing text the peer wasn't online to
      *  receive — the daemon flushes it on reconnect. */
-    append(peer: string, dir: "in" | "out", text: string, ts?: number, status?: "queued" | "sent" | "failed", via?: "online" | "offline"): ChatMessage;
+    append(peer: string, dir: "in" | "out", text: string, ts?: number, status?: "sending" | "queued" | "sent" | "failed", via?: "online" | "offline"): ChatMessage;
     /** Set (or, with undefined, clear) the delivery status on a text message.
      *  Used to flip a "queued" message to delivered once it's actually sent.
      *  No-op if the id isn't found or is a file entry. Returns true if patched. */
-    setStatus(peer: string, id: string, status?: "queued" | "sent" | "failed"): boolean;
+    setStatus(peer: string, id: string, status?: "sending" | "queued" | "sent" | "failed"): boolean;
     /** Outgoing messages still awaiting delivery (peer was offline), oldest
      *  first — both queued text and queued file chips. The daemon drains this
      *  on a friend's reconnect. */

package/dist/daemon/message-store.js

@@ -33,6 +33,11 @@ export class MessageStore {
             let total = 0;
             for (const [peer, msgs] of Object.entries(raw)) {
                 if (Array.isArray(msgs)) {
+                    // A "sending" state cannot survive a restart — the attempt it
+                    // described died with the process. Requeue so the flush owns it.
+                    for (const m of msgs)
+                        if (m.status === "sending")
+                            m.status = "queued";
                     this.byPeer.set(peer, msgs);
                     total += msgs.length;
                 }

package/dist/daemon/server.js

@@ -458,14 +458,23 @@ export class DaemonServer {
                     //
                     // Same rule the embedded host and the browser client already follow:
                     // a delivery failure is a STATE on the message, never its absence.
-                    const msg = this.messageStore?.append(userid, "out", text, Date.now(), "queued");
+                    //
+                    // Stored as "sending", NOT "queued", while our own attempt runs. The
+                    // reconnect flush re-sends everything "queued", and sendText brings
+                    // the session up itself when it has to — which fires the very
+                    // friend-connection event that triggers the flush. Stored as "queued"
+                    // the message went out twice, 10-20 ms apart (seen on every daemon
+                    // sender in ~/.agentnet/messages.json). "queued" now means exactly
+                    // one thing: nobody is sending this, the flush must.
+                    const online = !!this.peerManager?.isFriendOnline(userid);
+                    const msg = this.messageStore?.append(userid, "out", text, Date.now(), online ? "sending" : "queued");
                     this.friendMeta?.ensure(userid);
                     this.ipcEvents.emit("event", { type: "chat", userid, dir: "out" });
-                    if (!msg || !this.peerManager?.isFriendOnline(userid)) {
+                    if (!msg || !online) {
                         this.logger.info(`Queued text for ${userid.slice(0, 8)} (delivers on reconnect)`);
                         return;
                     }
-                    // Deliver in the background; the reconnect flush covers a failure.
+                    // Deliver in the background; on failure hand it to the reconnect flush.
                     void (async () => {
                         try {
                             await this.peerManager.sendText(userid, text);
@@ -473,7 +482,8 @@ export class DaemonServer {
                             this.messageStore?.setStatus(userid, msg.id, undefined); // delivered
                         }
                         catch (e) {
-                            this.logger.warn(`sendText to ${userid.slice(0, 8)} failed, stays queued: ${e.message}`);
+                            this.logger.warn(`sendText to ${userid.slice(0, 8)} failed, queued for reconnect: ${e.message}`);
+                            this.messageStore?.setStatus(userid, msg.id, "queued");
                         }
                         this.ipcEvents.emit("event", { type: "chat", userid, dir: "out" });
                     })();

package/dist/dora/dora-integration.js

@@ -129,6 +129,11 @@ export class DoraIntegration {
         // crashed the daemon on startup.
         try {
             let record;
+            // True when the preferred IP was refused and config says we keep it
+            // anyway (dora.keepConfiguredIp). We then run unregistered on the
+            // configured address, still read the roster, and let the bootstrap
+            // retry keep asking for the preferred IP until its owner accepts it.
+            let keptConfiguredIp = false;
             try {
                 record = await this.tryRegister(myUserid, myAddress, this.opts.preferredIp);
             }
@@ -154,41 +159,63 @@ export class DoraIntegration {
                 const retryWithoutPreferredIp = /held by|in use|already taken|already in use|out of range/i.test(msg);
                 if (!retryWithoutPreferredIp)
                     throw err;
-                this.logger.warn(`Preferred IP ${this.opts.preferredIp} not available (${msg}) — requesting any free IP`);
-                record = await this.tryRegister(myUserid, myAddress);
+                if (this.opts.config.keepConfiguredIp && this.opts.preferredIp) {
+                    this.logger.warn(`Preferred IP ${this.opts.preferredIp} not accepted (${msg}) — keeping it (dora.keepConfiguredIp); ` +
+                        `running unregistered on it and retrying the registration in the background`);
+                    keptConfiguredIp = true;
+                }
+                else {
+                    this.logger.warn(`Preferred IP ${this.opts.preferredIp} not available (${msg}) — requesting any free IP`);
+                    record = await this.tryRegister(myUserid, myAddress);
+                }
             }
-            this.allocatedIp = record.virtualIp;
-            this.registered = true;
-            this.logger.info(`Registered with dora: ${record.name} -> ${record.virtualIp}`);
+            if (record) {
+                this.allocatedIp = record.virtualIp;
+                this.registered = true;
+                this.logger.info(`Registered with dora: ${record.name} -> ${record.virtualIp}`);
+            }
+            else {
+                this.allocatedIp = this.opts.preferredIp;
+            }
+            const selfIp = record?.virtualIp ?? this.opts.preferredIp ?? "";
+            const selfName = record?.name ?? this.opts.nodeName;
             // Add self to the in-memory IPAM so the local DNS server can
             // answer `<my-name>.<domain>` queries from this very host.
             // mergeRosterIntoIpam skips own entry (sensible — peers don't
             // need to "auto-friend themselves"), but the DNS resolver
             // looks at the same IPAM, so without this entry `dig snoopy.
             // decent` from snoopy itself NXDOMAINs.
-            this.opts.ipam.assignPeer({
-                name: record.name,
-                carrierId: myUserid,
-                virtualIp: record.virtualIp,
-                services: [],
-            });
-            // Pull the full roster. We don't fail the whole bootstrap if
-            // list() throws — we still have our own address allocated.
-            try {
-                const roster = await this.client.list();
-                this.mergeRosterIntoIpam(roster, myUserid);
+            if (selfIp) {
+                this.opts.ipam.assignPeer({
+                    name: selfName,
+                    carrierId: myUserid,
+                    virtualIp: selfIp,
+                    services: [],
+                });
             }
-            catch (err) {
-                this.logger.warn(`Initial roster fetch failed: ${err}`);
+            // Pull the full roster and start the periodic refresh — once. The
+            // bootstrap retry re-enters this method every 30s while we are
+            // unregistered (keepConfiguredIp), and must not stack refresh timers.
+            if (!this.refreshTimer) {
+                // We don't fail the whole bootstrap if list() throws — we still
+                // have our own address.
+                try {
+                    const roster = await this.client.list();
+                    this.mergeRosterIntoIpam(roster, myUserid);
+                }
+                catch (err) {
+                    this.logger.warn(`Initial roster fetch failed: ${err}`);
+                }
+                const interval = this.opts.config.refreshIntervalMs ?? 60_000;
+                this.refreshTimer = setInterval(() => {
+                    this.refreshRoster(myUserid).catch((err) => {
+                        this.logger.debug(`Roster refresh: ${err}`);
+                    });
+                }, interval);
             }
-            // Start periodic refresh.
-            const interval = this.opts.config.refreshIntervalMs ?? 60_000;
-            this.refreshTimer = setInterval(() => {
-                this.refreshRoster(myUserid).catch((err) => {
-                    this.logger.debug(`Roster refresh: ${err}`);
-                });
-            }, interval);
-            return this.allocatedIp;
+            if (keptConfiguredIp)
+                this.scheduleBootstrapRetry();
+            return this.allocatedIp ?? "";
         }
         catch (err) {
             if (err instanceof AllRegistriesUnavailableError) {

package/dist/types.d.ts

@@ -204,6 +204,24 @@ export interface DoraConfig {
      *    friended on every refresh; everything else is left alone.
      */
     autoFriend?: "none" | "all" | string[];
+    /**
+     * Never let a registry move this node off `network.ip`.
+     *
+     * By default, when the preferred IP is rejected (collision, or "out of
+     * range" because the registry that owns its band did not answer in time),
+     * the daemon registers for ANY free IP and rebuilds the TUN on it. That is
+     * right for a throwaway node and catastrophic for one whose address is
+     * pinned elsewhere — an exit node listed by IP in every app, a server in
+     * someone's /etc/hosts. 2026-09-07: a routine restart moved the tokyo exit
+     * from 10.86.68.90 to 10.86.64.16 and gojipower from 10.86.166.16 to
+     * 10.86.192.10 this way.
+     *
+     * With `keepConfiguredIp: true` the daemon keeps `network.ip`, still
+     * pulls the roster (so `.decent` names resolve), and keeps retrying the
+     * preferred registration in the background until the owning registry
+     * accepts it. Set it on every node whose IP other things depend on.
+     */
+    keepConfiguredIp?: boolean;
 }
 export interface DecentAgentNetConfig {
     node: NodeConfig;

package/dist/ui/desktop/app.js

@@ -1,4 +1,4 @@
-window.__DK_UI_VERSION="0.1.298";
+window.__DK_UI_VERSION="0.1.300";
 const ICON_PATHS = {
   // ---- tab bar (the four must feel like one set) ----
   users: '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/>',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/lan",
-  "version": "0.1.298",
+  "version": "0.1.300",
   "description": "Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.",
   "type": "module",
   "main": "./dist/index.js",