@decentnetwork/peer 0.1.63 → 0.1.64

package/dist/peer.js

@@ -92,7 +92,13 @@ const REHS_ACCEPT_MS = readEnvInt("DECENT_REHS_ACCEPT_MS", 2500);
 const REHS_WINDOW_MS = readEnvInt("DECENT_REHS_WINDOW_MS", 8000);
 // Re-handshake when we keep receiving undecryptable crypto data from a known
 // friend's endpoint (desynced sessions), rate-limited per friend.
-const REINIT_ON_DESYNC_MS = readEnvInt("DECENT_REINIT_ON_DESYNC_MS", 2000);
+// Conservative: deleting a session forces a re-handshake which ROTATES our
+// ephemeral key, so doing it too eagerly turns a transient blip into a
+// rotate→desync→delete thrash. Only nuke a session that's been UNABLE to
+// decrypt anything for a long time (genuinely dead, well past any
+// establishment-transition window), and at most once per long interval.
+const REINIT_ON_DESYNC_MS = readEnvInt("DECENT_REINIT_ON_DESYNC_MS", 12000);
+const REINIT_STUCK_MS = readEnvInt("DECENT_REINIT_STUCK_MS", 20000);
 // How long a relay path stays "confirmed" (carrying bulk data on its own, no
 // tcp-relay fan-out) after the last packet received over it. The relay
 // keepalive refreshes this every ~4s on a healthy path, so a generous window
@@ -267,6 +273,9 @@ export class Peer {
     // #initiateSession every few seconds for every friend; without this
     // dedupe, lower-pubkey side floods the log with "deferring to peer".
     #initiateSkipLogged = new Set();
+    // Per-friend last time we deleted a desynced session (rate-limit; survives the
+    // session deletion, unlike a field on the session object itself).
+    #lastDesyncDeleteMs = new Map();
     // Cached server-reflexive (public) UDP endpoint of our #udp socket,
     // learned via STUN. Cone-NAT mappings are stable for the socket
     // lifetime, so we only re-probe every ~60s. Used to tell friends where
@@ -1832,24 +1841,41 @@ export class Peer {
                 this.#debugVerboseLog(`unknown messenger packet kind ${kind} from ${friendId}`);
                 return;
             }
-            // We received crypto data we can't decrypt from a KNOWN friend's endpoint:
-            // our two sessions are desynced (different keys) and NEITHER side will
-            // re-handshake on its own, because each believes it is still established
-            // (the half-open breaker can't help — no handshakes are being exchanged).
-            // Kick a fresh handshake so we re-converge. Rate-limited per friend so a
-            // flood of undecryptable packets doesn't spam cookie requests.
-            if (!this.#remoteIsTcp(remote) && !viaRelay) {
+            // We received crypto data we can't decrypt from a KNOWN friend: our two
+            // sessions are desynced (different keys) and both are "established", so
+            // neither re-handshakes (#initiateSession no-ops on an established session,
+            // and the lower-pubkey side defers entirely). DELETE the stale session so
+            // the connection loop re-establishes cleanly via the single-initiator path
+            // (higher pubkey initiates a fresh cookie chain, lower responds, both
+            // derive the SAME key). This covers BOTH transports — the desync shows up
+            // over the TCP relay (remote = tcp:<friendId>:0) as well as direct UDP.
+            let desyncedFid;
+            if (this.#remoteIsTcp(remote)) {
+                const m = /^tcp:([A-Za-z0-9]+)/.exec(remote.address);
+                if (m && this.#friendSessions.has(m[1]))
+                    desyncedFid = m[1];
+            }
+            else if (!viaRelay) {
                 for (const [fid, st] of this.#friendSessions.entries()) {
-                    const matches = (st.remote?.host === remote.address && st.remote?.port === remote.port) ||
-                        (st.endpointCandidates ?? []).some((c) => c.host === remote.address && c.port === remote.port);
-                    if (!matches)
-                        continue;
-                    if (Date.now() - (st.lastReinitMs ?? 0) > REINIT_ON_DESYNC_MS) {
-                        st.lastReinitMs = Date.now();
-                        this.#debugLog(`no-session-matched from ${remote.address}:${remote.port} (friend ${fid}) — desynced, re-initiating handshake`);
-                        void this.#initiateSession(fid).catch(() => undefined);
+                    if ((st.remote?.host === remote.address && st.remote?.port === remote.port) ||
+                        (st.endpointCandidates ?? []).some((c) => c.host === remote.address && c.port === remote.port)) {
+                        desyncedFid = fid;
+                        break;
                     }
-                    break;
+                }
+            }
+            if (desyncedFid) {
+                const st = this.#friendSessions.get(desyncedFid);
+                // Only a GENUINELY stuck session (no successful decrypt for a while) —
+                // never nuke a healthy one on a stray/late undecryptable packet — and
+                // rate-limited via a map that survives the delete.
+                const working = st.lastPingRecvMs !== undefined && Date.now() - st.lastPingRecvMs < REINIT_STUCK_MS;
+                const lastDel = this.#lastDesyncDeleteMs.get(desyncedFid) ?? 0;
+                if (!working && Date.now() - lastDel > REINIT_ON_DESYNC_MS) {
+                    this.#lastDesyncDeleteMs.set(desyncedFid, Date.now());
+                    this.#debugLog(`no-session-matched from ${remote.address} (friend ${desyncedFid}) — desynced, deleting session for clean re-handshake`);
+                    this.#friendSessions.delete(desyncedFid);
+                    void this.#initiateSession(desyncedFid).catch(() => undefined);
                 }
             }
             this.#debugVerboseLog(`crypto data received from ${remote.address}:${remote.port} but no session matched`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.63",
+  "version": "0.1.64",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",