@decentnetwork/peer 0.1.124 → 0.1.127

package/dist/peer.js

@@ -393,8 +393,9 @@ export class Peer {
      *  same friend, and sharing one timestamp would let whichever ran first
      *  suppress the other for a full budget. */
     #onionLookupCooldown = new Map();
-    /** Consecutive failed endpoint lookups per (friend,target) — drives how wide
-     *  the next fan-out goes. Cleared on success. */
+    /** Consecutive failed endpoint lookups per (friend,target). Kept for
+     *  diagnostics — it no longer narrows the sweep (see the width comment in
+     *  #discoverAndCacheFriendEndpoint for why that was reverted). */
     #onionLookupMisses = new Map();
     // Per-friend cooldown for re-asserting the TCP-relay route toward an
     // unconnected friend (the "accepted friend that never connects" wedge —
@@ -1901,7 +1902,7 @@ export class Peer {
                     this.#debugLog(`cookie response: no tcp relay accepted oob send for ${senderId}`);
                 }
             }
-            else if (this.#isUnroutableSelfSource(remote.address, remote.port)) {
+            else if (this.#isUnroutableSelfSource(remote.address, remote.port, true)) {
                 // The request arrived sourced from our own TUN address (or our own
                 // socket) — an overlay routing artifact. Replying there loops into
                 // ourselves and dies. Answer over the relay OOB path instead, which
@@ -1996,7 +1997,7 @@ export class Peer {
             // poison the UDP send-back path.
             const fromTcp = this.#remoteIsTcp(remote);
             if (!fromTcp) {
-                this.#adoptRemote(matchedSession, remote.address, remote.port);
+                this.#adoptRemote(matchedSession, remote.address, remote.port, true);
             }
             else {
                 matchedSession.hasTcpRoute = true;
@@ -2070,7 +2071,7 @@ export class Peer {
                     state.hasTcpRoute = true;
                 }
                 else {
-                    this.#adoptRemote(state, remote.address, remote.port);
+                    this.#adoptRemote(state, remote.address, remote.port, true);
                 }
                 // CONVERGENCE RESYNC: the peer is retransmitting the SAME session pubkey
                 // we already hold, so OUR view of the session looks fine. But if we've
@@ -2267,7 +2268,7 @@ export class Peer {
                 // Don't set state.remote — there's no UDP endpoint for this peer.
             }
             else {
-                this.#adoptRemote(state, remote.address, remote.port);
+                this.#adoptRemote(state, remote.address, remote.port, true);
             }
             if (isNewSession) {
                 state.sendPacketNumber = 0;
@@ -2456,7 +2457,7 @@ export class Peer {
                     }
                     state.lastRelayRecvMs = Date.now();
                 }
-                else if (this.#isUnroutableSelfSource(remote.address, remote.port)) {
+                else if (this.#isUnroutableSelfSource(remote.address, remote.port, true)) {
                     // Sourced from our own TUN address / own socket (overlay routing
                     // artifact): the payload is real — deliver it — but this is NOT a
                     // usable bidirectional UDP path. Don't adopt it (replies loop into
@@ -2469,7 +2470,7 @@ export class Peer {
                     // Tailscale-exit hairpin source. Cheap string compare, NO interface
                     // syscall (that was the CCTV CPU regression) — safe at CCTV packet
                     // rates.
-                    this.#adoptRemote(state, remote.address, remote.port);
+                    this.#adoptRemote(state, remote.address, remote.port, true);
                     // A successfully decrypted packet arriving from a private address is
                     // stronger proof than an endpoint hint: it demonstrates that this
                     // exact host:port already reaches us. Do not require the address to be
@@ -2484,7 +2485,7 @@ export class Peer {
                     if (!state.lanRemoteHost &&
                         isPrivateAddress(remote.address) &&
                         !isCgnatAddress(remote.address) &&
-                        !this.#isUnroutableSelfSource(remote.address, remote.port)) {
+                        !this.#isUnroutableSelfSource(remote.address, remote.port, true)) {
                         state.lanRemoteHost = remote.address;
                         this.#rememberEndpointCandidate(state, remote.address, remote.port);
                         this.#debugLog(`lan_lock_confirmed friend=${friendId} host=${remote.address}:${remote.port} (decrypted UDP source)`);
@@ -3114,9 +3115,18 @@ export class Peer {
         // peer that only just came back is still found without waiting for a
         // restart. Widening beats a permanently narrow sweep: the failure we must
         // not introduce is "never discovers", not "discovers a bit later".
-        const misses = this.#onionLookupMisses.get(budgetKey) ?? 0;
-        const fullWidth = Math.max(8, Math.min(24, MAX_FRIEND_ROUTE_ATTEMPTS));
-        const width = misses === 0 || misses % 8 === 0 ? fullWidth : 4;
+        // Width stays FULL. An earlier cut narrowed repeats to 4 nodes and only
+        // went wide every 8th attempt — with the 25s budget that put 200s between
+        // full sweeps, and iOS peers (which come online in short windows and are
+        // the hardest to find at the best of times) stopped being seen at all.
+        // Reported from the field the same day: weili.beagles.eth went offline and
+        // stayed offline.
+        //
+        // Cost here is width x frequency, and the frequency gate above already
+        // took 3s -> 25s, an 8x cut on its own. Narrowing width bought another 6x
+        // and paid for it with the one property this code exists to provide.
+        // Keep the cheap half, drop the expensive one.
+        const width = Math.max(8, Math.min(24, MAX_FRIEND_ROUTE_ATTEMPTS));
         const queue = dedupeNodes(this.#knownNodes.length > 0 ? this.#knownNodes : this.#opts.bootstrapNodes)
             .filter((n) => !this.#isNodeBlacklisted(`${n.host}:${n.port}`))
             .sort((a, b) => this.#nodeScore(`${b.host}:${b.port}`) - this.#nodeScore(`${a.host}:${a.port}`))
@@ -3186,9 +3196,8 @@ export class Peer {
                 return true;
             }
         }
-        // Nothing found: remember, so the next sweep for this target probes
-        // narrowly instead of paying the full 24-node price again.
-        this.#onionLookupMisses.set(budgetKey, misses + 1);
+        // Nothing found: count it, for diagnostics only.
+        this.#onionLookupMisses.set(budgetKey, (this.#onionLookupMisses.get(budgetKey) ?? 0) + 1);
         return false;
     }
     async #announceSelfBestEffort(force = false, deadlineMs = Number.POSITIVE_INFINITY) {
@@ -4704,7 +4713,10 @@ export class Peer {
         }
         // An unroutable self-source is never the friend's endpoint (see
         // #adoptRemote) — don't let it poison the in-memory record either.
-        if (this.#isUnroutableSelfSource(host, port)) {
+        // observed=false: this path takes SPECULATIVE hints (DHT-PK extras,
+        // sendnodes-derived knownNodes), so a self-address here is a claim, not
+        // proof of a same-host peer.
+        if (this.#isUnroutableSelfSource(host, port, false)) {
             return;
         }
         // Important: do NOT persist this candidate to disk. Speculative endpoint
@@ -4755,19 +4767,37 @@ export class Peer {
      *  router and loop), or it's literally our own UDP socket. A self
      *  PHYSICAL address with a DIFFERENT port is routable — that's a
      *  same-host peer (e.g. the iOS simulator running on this Mac). */
-    #isUnroutableSelfSource(host, port) {
+    #isUnroutableSelfSource(host, port, observed) {
         if (isOwnVirtualAddress(host))
             return true;
         if (!isOwnAddress(host))
             return false;
         const ourPort = this.#udp?.localPort();
-        return ourPort !== undefined && port === ourPort;
+        if (ourPort !== undefined && port === ourPort)
+            return true;
+        // Our own physical IP on a DIFFERENT port is a same-host peer (the iOS
+        // simulator on this Mac) — but only when we actually RECEIVED a packet
+        // from there. A peer merely CLAIMING that address in its candidate list
+        // is not evidence: private ranges are reused everywhere, so two machines
+        // on unrelated networks routinely share one. Seen in the field between
+        // ubuntu-aaec and air-wli, both sitting on a 172.29/20: aaec adopted its
+        // OWN eth0 address as air-wli's endpoint and sent every IP packet to
+        // itself — friend "online", chat fine, ping 100% loss, and not a single
+        // drop recorded because nothing was dropped, just delivered to the wrong
+        // machine.
+        return !observed;
     }
-    #adoptRemote(session, host, port) {
+    /**
+     * @param observed true when host:port is the source of a datagram we
+     *   actually received, false when it is an address the peer advertised.
+     *   The distinction matters for self-addresses — see
+     *   {@link #isUnroutableSelfSource}.
+     */
+    #adoptRemote(session, host, port, observed = false) {
         // NEVER adopt an unroutable self-source as a friend's remote — replies
         // would loop into our own interface and die, the peer never hears back
         // and re-handshakes forever.
-        if (this.#isUnroutableSelfSource(host, port)) {
+        if (this.#isUnroutableSelfSource(host, port, observed)) {
             return;
         }
         if (session.lanRemoteHost &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.124",
+  "version": "0.1.127",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",