@decentnetwork/peer 0.1.129 → 0.1.131

package/dist/peer.js

@@ -968,7 +968,7 @@ export class Peer {
                 uint32ToLe(friendAddress.nospam),
                 appPayload
             ]);
-            const routes = await this.#discoverFriendRoutes(friendAddress.publicKey);
+            const routes = await this.#discoverFriendRoutes(friendAddress.publicKey, true);
             this.#debugLog(`friend route discovery done routes=${routes.length}`);
             if (routes.length === 0) {
                 // The direct net_crypto send needs a known endpoint for the target; to
@@ -2928,10 +2928,35 @@ export class Peer {
             // Ignore invalid offline payloads.
         }
     }
-    async #discoverFriendRoutes(friendPublicKey) {
+    /**
+     * @param userInitiated skips the budget. Adding a friend must not wait on a
+     *   throttle meant for background upkeep.
+     */
+    async #discoverFriendRoutes(friendPublicKey, userInitiated = false) {
         if (!this.#keyPair) {
             throw new Error("Peer is not started");
         }
+        // Same per-friend budget as #discoverAndCacheFriendEndpoint, enforced HERE
+        // for the same reason: this is the THIRD time today the cost simply moved
+        // to whichever caller was not gated. #sendOnionDhtPk's call sites were
+        // throttled, so the sweep underneath them became the top crypto entry
+        // instead — 17.9% of wall on gfax, climbing (20% -> 27% over ten minutes)
+        // rather than settling, because the DHT-PK path kept a FLAT 25s interval
+        // while the endpoint path had already been given backoff.
+        //
+        // A gate inside the function cannot be bypassed by a call site added later.
+        const routeKey = `routes:${carrierIdFromPublicKey(friendPublicKey)}`;
+        if (!userInitiated) {
+            const misses = this.#onionLookupMisses.get(routeKey) ?? 0;
+            const budget = Math.min(DHT_PK_ANNOUNCE_COOLDOWN_MS * Math.max(1, misses), ONION_LOOKUP_MAX_BACKOFF_MS);
+            const since = Date.now() - (this.#onionLookupCooldown.get(routeKey) ?? 0);
+            if (since < budget) {
+                this.#debugLog(`route discovery for ${routeKey} skipped: ${Math.round(since / 1000)}s ` +
+                    `since last (budget ${Math.round(budget / 1000)}s, misses ${misses})`);
+                return [];
+            }
+            this.#onionLookupCooldown.set(routeKey, Date.now());
+        }
         const searchKey = createEphemeralKeyPair();
         const routes = [];
         const routeSeen = new Set();
@@ -3075,6 +3100,15 @@ export class Peer {
                 }
             }
         }
+        // Miss accounting drives the backoff above. Without it the budget stays at
+        // its 25s floor forever and the gate does nothing for the friends that
+        // actually cost us — the ones that never resolve.
+        if (!userInitiated) {
+            if (routes.length > 0)
+                this.#onionLookupMisses.delete(routeKey);
+            else
+                this.#onionLookupMisses.set(routeKey, (this.#onionLookupMisses.get(routeKey) ?? 0) + 1);
+        }
         return routes;
     }
     async #discoverAndCacheFriendEndpoint(friendId, searchPublicKey) {
@@ -4821,6 +4855,26 @@ export class Peer {
         if (this.#isUnroutableSelfSource(host, port, observed)) {
             return;
         }
+        // An ADVERTISED private address is only usable if we are on that network.
+        //
+        // Same provenance rule as the self-address check above, one step wider: a
+        // packet that ARRIVED from a private address proves the path exists, but a
+        // peer merely listing one proves nothing — RFC1918 ranges are reused
+        // everywhere. Seen in the field between tokyo (Japan) and a laptop at home:
+        // tokyo adopted 10.0.0.245, an address that only means anything inside that
+        // house, and sent every IP packet there. Friend online, session
+        // established, transport "both", ping 100% loss.
+        //
+        // Only reached for advertised candidates, so the cached-but-not-free
+        // getPhysicalLanSubnets() stays off the per-packet path (see the CCTV CPU
+        // regression note on #isUnroutableSelfSource).
+        if (!observed &&
+            isPrivateAddress(host) &&
+            !isCgnatAddress(host) &&
+            !getPhysicalLanSubnets().some((sub) => isInIpv4Subnet(host, sub))) {
+            this.#debugLog(`ignoring advertised private endpoint ${host}:${port} — not on any of our LANs`);
+            return;
+        }
         if (session.lanRemoteHost &&
             session.remote?.host === session.lanRemoteHost &&
             host !== session.lanRemoteHost &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.129",
+  "version": "0.1.131",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",