@decentnetwork/peer 0.1.114 → 0.1.116

package/dist/peer.js

@@ -841,7 +841,24 @@ export class Peer {
         // reply) makes the hot distance-sort + memory grow without limit; a few
         // hundred nodes is plenty to stay findable and to announce on the closest.
         const merged = dedupeNodes([...nodes, ...this.#knownNodes]);
-        this.#knownNodes = merged.length > MAX_KNOWN_NODES ? merged.slice(0, MAX_KNOWN_NODES) : merged;
+        if (merged.length > MAX_KNOWN_NODES) {
+            const kept = merged.slice(0, MAX_KNOWN_NODES);
+            // Pin the bootstrap nodes. They are the only guaranteed-public,
+            // onion-capable nodes we have; newest-first truncation on a busy DHT
+            // evicted them within hours, leaving the onion hop pool with only
+            // NAT'd/CGNAT peers — every onion path died at hop A, so announce and
+            // DHTPK delivery failed for days ("no onion path" / "self announce
+            // step1 no response" floods) and natives could never (re)discover us.
+            const keptIds = new Set(kept.map((node) => `${node.host}:${node.port}`));
+            for (const bn of this.#opts.bootstrapNodes) {
+                if (!keptIds.has(`${bn.host}:${bn.port}`))
+                    kept.push(bn);
+            }
+            this.#knownNodes = kept;
+        }
+        else {
+            this.#knownNodes = merged;
+        }
     }
     knownNodes() {
         return [...this.#knownNodes];
@@ -1808,6 +1825,20 @@ export class Peer {
             if (!fromTcp) {
                 this.#cacheFriendRemote(senderId, remote.address, remote.port, request.senderRealPublicKey, request.senderDhtPublicKey);
             }
+            else if (request.senderDhtPublicKey && request.senderDhtPublicKey.length === 32) {
+                // TCP arrival: skip the endpoint, but STILL learn the sender's DHT
+                // key. Natives rotate it every app restart and the relay routes
+                // CRYPTO_DATA by it — a relay-only native (its UDP unreachable to
+                // us) otherwise kept its stale key here, every routed send went to
+                // a key the relay didn't know, and the peer — never receiving our
+                // data — re-keyed every 8s forever (the iPhone churn loop).
+                const session = this.#friendSessions.get(senderId);
+                if (session && !(session.friendDhtPublicKey && Buffer.from(session.friendDhtPublicKey).equals(Buffer.from(request.senderDhtPublicKey)))) {
+                    this.#debugLog(`dht_key_from_tcp_cookie friend=${senderId} new=${carrierIdFromPublicKey(request.senderDhtPublicKey)}`);
+                    session.friendDhtPublicKey = request.senderDhtPublicKey;
+                }
+                this.#learnFriendDhtKey(senderId, request.senderDhtPublicKey);
+            }
             const response = createCookieResponse({
                 request,
                 receiverDhtSecretKey: this.#keyPair.secretKey,
@@ -2071,8 +2102,18 @@ export class Peer {
             else {
                 if (!state.friendRealPublicKey)
                     state.friendRealPublicKey = hs.senderRealPublicKey;
-                if (!state.friendDhtPublicKey)
+                // ALWAYS take the handshake's DHT key, not only when empty: the
+                // handshake authenticates the sender's real key, and natives rotate
+                // their DHT key every restart. Keeping a stale key here sent every
+                // relay-routed CRYPTO_DATA packet to a key the relay didn't know —
+                // silent drop, peer re-keys every 8s (iPhone churn loop).
+                if (hs.senderDhtPublicKey && hs.senderDhtPublicKey.length === 32 &&
+                    !(state.friendDhtPublicKey && Buffer.from(state.friendDhtPublicKey).equals(Buffer.from(hs.senderDhtPublicKey)))) {
+                    if (state.friendDhtPublicKey) {
+                        this.#debugLog(`dht_key_from_hs friend=${friendId} new=${carrierIdFromPublicKey(hs.senderDhtPublicKey)}`);
+                    }
                     state.friendDhtPublicKey = hs.senderDhtPublicKey;
+                }
             }
             if (hs.senderDhtPublicKey && hs.senderDhtPublicKey.length === 32) {
                 this.#learnFriendDhtKey(friendId, hs.senderDhtPublicKey);
@@ -5512,6 +5553,17 @@ export class Peer {
         }
         if (!friendId)
             return;
+        // If ANY established session already uses this DHT key, the key's owner
+        // is known and it is not `friendId` — a shared own-host target (the
+        // simulator) answers EVERY prober's probe, and without this check each
+        // stranded friend in turn "adopted" the sim's key during its slot,
+        // endlessly poisoning its own routing.
+        for (const [fid, s] of this.#friendSessions) {
+            if (fid === friendId || !s.established || !s.friendDhtPublicKey)
+                continue;
+            if (Buffer.from(s.friendDhtPublicKey).equals(Buffer.from(senderDhtPk)))
+                return;
+        }
         // The sender pk currently maps to a DIFFERENT friend. If that friend's
         // session is ESTABLISHED, the key genuinely belongs to them — don't
         // cross-wire. If it is NOT established, the mapping itself may be a
@@ -6149,6 +6201,15 @@ export class Peer {
             if (id === nodeDId || node.host === nodeD.host || seenHosts.has(node.host)) {
                 continue;
             }
+            // Onion hops must be PUBLICLY routable: they forward our request onward
+            // and route the response back. A CGNAT (Tailscale 100.64/10), RFC1918,
+            // or own-host address cannot do either from the open internet — yet
+            // such peer endpoints leak into #knownNodes and were being picked as
+            // hop A (observed: 1900+ onion initials sent via a friend's Tailscale
+            // 100.76.x address, all black-holed).
+            if (isPrivateAddress(node.host) || isCgnatAddress(node.host) || isOwnAddress(node.host)) {
+                continue;
+            }
             // Skip blacklisted relays — onion paths through dead nodes
             // silently swallow the request and the announce times out.
             if (this.#isNodeBlacklisted(id)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.114",
+  "version": "0.1.116",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",