@decentnetwork/peer 0.1.69 → 0.1.70

package/dist/peer.js

@@ -82,6 +82,18 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
+// A session whose keys we've PROVEN (decrypted ≥1 real packet from the peer) is
+// NOT torn down at FRIEND_TIMEOUT_MS. A transient all-transport blackout — e.g.
+// the GFW throttling a China<->abroad path for tens of seconds — must not trigger
+// a re-handshake: an ASYMMETRIC re-handshake (one side re-keys while the other
+// keeps its session) is exactly what desyncs the two sessions and produces the
+// connect/disconnect CHURN that breaks the exit. Instead we keep the proven keys
+// and keep probing over every transport; when the path recovers, a single packet
+// resumes the SAME session with no re-handshake. Only after this much longer hard
+// window do we treat the path as truly dead and re-handshake. (Unproven sessions
+// — established but never carried a packet — still tear down at FRIEND_TIMEOUT_MS
+// so a wedged handshake self-heals.)
+const PROVEN_SESSION_HARD_TIMEOUT_MS = readEnvInt("DECENT_PROVEN_SESSION_HARD_TIMEOUT_MS", 180_000);
 // How long the direct UDP path may go without an inbound packet before we
 // release a physical-LAN lock (so a peer that left the LAN can recover onto the
 // public/relay path). 12s ≈ 3 missed 4s keepalives — long enough to never trip
@@ -2539,8 +2551,24 @@ export class Peer {
                 // non-established branch below, which re-initiates a fresh
                 // connection — turning a permanent wedge into a ~timeout self-heal.
                 const lastAlive = session.lastPingRecvMs ?? session.sessionEstablishedAtMs ?? now;
-                if (now - lastAlive > FRIEND_TIMEOUT_MS) {
-                    this.#debugLog(`session timeout for ${friendId} (no ping in ${now - lastAlive}ms; ` +
+                const silentFor = now - lastAlive;
+                // Proven = we've decrypted ≥1 real packet, so the keys are known-good and
+                // a silence is a transport blackout (GFW), not a desync. Give proven
+                // sessions a long grace so a blackout doesn't churn them via re-handshake;
+                // unproven sessions still time out fast to self-heal a wedged handshake.
+                const proven = session.lastPingRecvMs !== undefined;
+                const deadline = proven ? PROVEN_SESSION_HARD_TIMEOUT_MS : FRIEND_TIMEOUT_MS;
+                if (proven && silentFor > FRIEND_TIMEOUT_MS && silentFor <= deadline) {
+                    // Blackout grace: keep the proven session and keep probing (the
+                    // keepalive + UDP re-punch + relay-keepalive below all still run). Do
+                    // NOT delete or re-handshake — that's what desyncs and churns. The peer,
+                    // running the same logic, also keeps its half, so when the path recovers
+                    // both resume in sync. Status stays as-is; the exit's own health probe
+                    // (multi-exit router) handles failover meanwhile.
+                    this.#debugVerboseLog(`session blackout-grace ${friendId} (silent ${silentFor}ms, proven — keeping keys, not re-handshaking)`);
+                }
+                else if (silentFor > deadline) {
+                    this.#debugLog(`session timeout for ${friendId} (no ping in ${silentFor}ms, proven=${proven}; ` +
                         `lastPingRecv=${session.lastPingRecvMs ?? "never"}) — tearing down to re-handshake`);
                     this.#friendSessions.delete(friendId);
                     this.#setFriendOffline(friendId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.69",
+  "version": "0.1.70",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",