@decentnetwork/peer 0.1.69 → 0.1.71

package/dist/compat/filetransfer.js

@@ -30,15 +30,23 @@ export const MAX_CONCURRENT_FILE_PIPES = 256;
 export const MAX_FILE_DATA_SIZE = 1367;
 export const FILECONTROL = { ACCEPT: 0, PAUSE: 1, KILL: 2, SEEK: 3, ACK: 4 };
 export const FILEKIND = { DATA: 0, AVATAR: 1 };
-// Reliability tuning. We use a FIXED in-flight window (not TCP-style AIMD): a
-// file transfer over a private direct path should treat packet loss as RANDOM
-// (lossy Wi-Fi / long-haul jitter), NOT as congestion — backing the window off
-// on every random drop collapsed throughput to a crawl (minutes for a big
-// file). Instead, keep the window large and just retransmit the gaps fast. The
-// 4 MB UDP socket buffer absorbs the burst; the receiver buffers by offset, so
-// reordering is free.
-const WINDOW_CHUNKS = 768; // ~1 MB in flight — fills a 200ms-RTT path at ~5 MB/s
-const WATCHDOG_MS = 150; // resend from the ack point if no progress this long
+// Reliability tuning. We RAMP an in-flight window (AIMD-lite) rather than pin it:
+//  - RANDOM single-packet loss (dup-ack with a gap) is NOT congestion — fast-
+//    retransmit the hole and DON'T shrink the window, so lossy-but-fat paths
+//    (Wi-Fi / long-haul jitter) keep full throughput (the original intent).
+//  - A SUSTAINED stall (no ack progress for ~RTT) IS congestion — halve the
+//    window so we stop flooding the path. This is what keeps the *session* alive
+//    during a big transfer over a thin/relayed hop: without it, a fixed 1 MB
+//    window blasted go-back-N saturates the path, starves the net_crypto
+//    keepalive, and the whole session (ping included) times out. On a good path
+//    the window ramps back to WINDOW_CHUNKS within a few RTTs → same speed.
+// The 4 MB UDP socket buffer absorbs bursts; the receiver buffers by offset.
+const WINDOW_CHUNKS = 768; // ~1 MB — the window CAP (fills a 200ms-RTT path at ~5 MB/s)
+const CWND_INIT_CHUNKS = 96; // ~131 KB start — ramps to the cap fast on a clean path
+const CWND_MIN_CHUNKS = 24; // ~33 KB floor — still enough to keep a thin path busy
+const CWND_GROW_CHUNKS = 48; // additive increase per ack-progress event
+const WATCHDOG_MS = 150; // stall poll cadence / base no-progress patience
+const WATCHDOG_MAX_MS = 2400; // cap the RTT-adaptive stall patience (high-RTT relay paths)
 const FAST_RT_MIN_MS = 40; // min gap between fast-retransmits of the same hole (≈1 RTT)
 const ACK_THROTTLE_MS = 15; // coalesce receiver acks (fast enough to drive fast-retransmit)
 const REACK_MS = 200; // receiver keep-alive re-ack cadence
@@ -140,6 +148,7 @@ export class FileTransferManager {
             fileNumber, fileId, name: opts.name, data, size: data.length,
             acked: 0, nextSend: 0, pumping: false, started: false, req, startMs: nowMs(),
             lastProgressAcked: 0, lastAckAdvanceMs: nowMs(), lastResendMs: 0,
+            cwnd: CWND_INIT_CHUNKS, stalls: 0,
         };
         this.#map(this.#sending, friendId).set(fileNumber, st);
         void this.send(friendId, PACKET_ID_FILE_SENDREQUEST, req).catch(() => undefined);
@@ -360,9 +369,12 @@ export class FileTransferManager {
         const ackedOffset = readU32be(data, 0);
         const maxRecv = data.length >= 8 ? readU32be(data, 4) : ackedOffset;
         if (ackedOffset > st.acked) {
-            // Progress.
+            // Progress. The path is delivering → additively re-open the window (up to
+            // the cap) and clear the stall streak (patience shrinks back to the base).
             st.acked = Math.min(ackedOffset, st.size);
             st.lastAckAdvanceMs = nowMs();
+            st.cwnd = Math.min(WINDOW_CHUNKS, st.cwnd + CWND_GROW_CHUNKS);
+            st.stalls = 0;
             if (st.acked - st.lastProgressAcked >= 256 * 1024 || st.acked >= st.size) {
                 st.lastProgressAcked = st.acked;
                 this.emit("file-progress", { friendId, fileId: hex(st.fileId), received: st.acked, total: st.size, sending: true });
@@ -402,7 +414,12 @@ export class FileTransferManager {
                 }
                 if (st.acked >= st.size)
                     return;
-                if (nowMs() - st.lastAckAdvanceMs < WATCHDOG_MS) {
+                // RTT-adaptive patience: after consecutive stalls, wait longer before
+                // deciding the path stalled — so a high-RTT relay hop doesn't trigger a
+                // spurious go-back-N re-blast before an ACK could even have returned
+                // (that spurious re-blast is exactly what collapses a thin path).
+                const patience = Math.min(WATCHDOG_MAX_MS, WATCHDOG_MS << Math.min(st.stalls, 4));
+                if (nowMs() - st.lastAckAdvanceMs < patience) {
                     stalledSinceMs = nowMs();
                     return;
                 }
@@ -411,6 +428,12 @@ export class FileTransferManager {
                     this.emit("file-cancel", { friendId, fileId: hex(st.fileId), sending: true, reason: "timeout" });
                     return;
                 }
+                // Sustained stall = congestion/path signal → multiplicatively cut the
+                // window so we STOP flooding. This frees the path for the net_crypto
+                // keepalive + acks, keeping the session (and ping) alive; the transfer
+                // then self-clocks back up as acks resume.
+                st.stalls++;
+                st.cwnd = Math.max(CWND_MIN_CHUNKS, Math.floor(st.cwnd / 2));
                 st.lastAckAdvanceMs = nowMs();
                 st.lastResendMs = nowMs();
                 if (st.nextSend > st.acked)
@@ -425,7 +448,7 @@ export class FileTransferManager {
         st.pumping = true;
         try {
             while (this.#map(this.#sending, friendId).has(st.fileNumber) && st.acked < st.size) {
-                const windowEnd = Math.min(st.acked + WINDOW_CHUNKS * MAX_FILE_DATA_SIZE, st.size);
+                const windowEnd = Math.min(st.acked + st.cwnd * MAX_FILE_DATA_SIZE, st.size);
                 if (st.nextSend >= windowEnd)
                     break; // window full / all sent — wait for acks
                 const off = st.nextSend;

package/dist/peer.js

@@ -82,6 +82,18 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
+// A session whose keys we've PROVEN (decrypted ≥1 real packet from the peer) is
+// NOT torn down at FRIEND_TIMEOUT_MS. A transient all-transport blackout — e.g.
+// the GFW throttling a China<->abroad path for tens of seconds — must not trigger
+// a re-handshake: an ASYMMETRIC re-handshake (one side re-keys while the other
+// keeps its session) is exactly what desyncs the two sessions and produces the
+// connect/disconnect CHURN that breaks the exit. Instead we keep the proven keys
+// and keep probing over every transport; when the path recovers, a single packet
+// resumes the SAME session with no re-handshake. Only after this much longer hard
+// window do we treat the path as truly dead and re-handshake. (Unproven sessions
+// — established but never carried a packet — still tear down at FRIEND_TIMEOUT_MS
+// so a wedged handshake self-heals.)
+const PROVEN_SESSION_HARD_TIMEOUT_MS = readEnvInt("DECENT_PROVEN_SESSION_HARD_TIMEOUT_MS", 180_000);
 // How long the direct UDP path may go without an inbound packet before we
 // release a physical-LAN lock (so a peer that left the LAN can recover onto the
 // public/relay path). 12s ≈ 3 missed 4s keepalives — long enough to never trip
@@ -2539,8 +2551,24 @@ export class Peer {
                 // non-established branch below, which re-initiates a fresh
                 // connection — turning a permanent wedge into a ~timeout self-heal.
                 const lastAlive = session.lastPingRecvMs ?? session.sessionEstablishedAtMs ?? now;
-                if (now - lastAlive > FRIEND_TIMEOUT_MS) {
-                    this.#debugLog(`session timeout for ${friendId} (no ping in ${now - lastAlive}ms; ` +
+                const silentFor = now - lastAlive;
+                // Proven = we've decrypted ≥1 real packet, so the keys are known-good and
+                // a silence is a transport blackout (GFW), not a desync. Give proven
+                // sessions a long grace so a blackout doesn't churn them via re-handshake;
+                // unproven sessions still time out fast to self-heal a wedged handshake.
+                const proven = session.lastPingRecvMs !== undefined;
+                const deadline = proven ? PROVEN_SESSION_HARD_TIMEOUT_MS : FRIEND_TIMEOUT_MS;
+                if (proven && silentFor > FRIEND_TIMEOUT_MS && silentFor <= deadline) {
+                    // Blackout grace: keep the proven session and keep probing (the
+                    // keepalive + UDP re-punch + relay-keepalive below all still run). Do
+                    // NOT delete or re-handshake — that's what desyncs and churns. The peer,
+                    // running the same logic, also keeps its half, so when the path recovers
+                    // both resume in sync. Status stays as-is; the exit's own health probe
+                    // (multi-exit router) handles failover meanwhile.
+                    this.#debugVerboseLog(`session blackout-grace ${friendId} (silent ${silentFor}ms, proven — keeping keys, not re-handshaking)`);
+                }
+                else if (silentFor > deadline) {
+                    this.#debugLog(`session timeout for ${friendId} (no ping in ${silentFor}ms, proven=${proven}; ` +
                         `lastPingRecv=${session.lastPingRecvMs ?? "never"}) — tearing down to re-handshake`);
                     this.#friendSessions.delete(friendId);
                     this.#setFriendOffline(friendId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.69",
+  "version": "0.1.71",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",