@decentnetwork/peer 0.1.92 → 0.1.94

package/dist/peer.js

@@ -593,10 +593,8 @@ export class Peer {
         };
     }
     async stop() {
-        if (this.#tcpRelays) {
-            await this.#tcpRelays.stop().catch(() => { });
-            this.#tcpRelays = undefined;
-        }
+        // Stop background producers first so no keepalive/profile packet can race
+        // behind the shutdown notice and make the remote session look live again.
         if (this.#expressPollTimer) {
             clearInterval(this.#expressPollTimer);
             this.#expressPollTimer = undefined;
@@ -613,6 +611,28 @@ export class Peer {
             clearInterval(this.#friendConnectionTimer);
             this.#friendConnectionTimer = undefined;
         }
+        // Gracefully retire every established net_crypto session before closing
+        // UDP/TCP. The identity key survives an AgentNet restart but the ephemeral
+        // session key does not. Without PACKET_ID_KILL, a service node keeps the old
+        // established session and rejects the restarted daemon's new-key handshake
+        // until its liveness timeout expires (or the service node is restarted).
+        // Carrier/toxcore peers already handle KILL by deleting that one session, so
+        // this is wire-compatible with older holders and does not disturb any other
+        // friend served by an exit node.
+        const establishedFriends = [...this.#friendSessions.entries()]
+            .filter(([, session]) => session.established)
+            .map(([friendId]) => friendId);
+        if (establishedFriends.length > 0) {
+            await Promise.allSettled(establishedFriends.map((friendId) => this.#sendMessengerPacket(friendId, PACKET_ID_KILL, new Uint8Array())));
+            // TcpRelayClient.close() destroys its socket. Give queued relay writes a
+            // brief chance to reach the relay before tearing transports down. UDP and
+            // TURN sends have already been handed to their sockets at this point.
+            await sleep(250);
+        }
+        if (this.#tcpRelays) {
+            await this.#tcpRelays.stop().catch(() => { });
+            this.#tcpRelays = undefined;
+        }
         this.#udp.off("datagram", this.#onDatagram);
         await this.#udp.stop();
         // Release the TURN allocation + its dedicated socket.
@@ -1740,10 +1760,19 @@ export class Peer {
                 const now = Date.now();
                 const peerSendingUndecryptable = state.undecryptableRecvMs !== undefined &&
                     now - state.undecryptableRecvMs < FRIEND_TIMEOUT_MS;
+                // A duplicate handshake can also be the first packet from a freshly
+                // restarted peer whose KILL notice was lost during shutdown. The
+                // holder still has the peer's old accepted session shell, while the
+                // restarted process needs our handshake reply before it can derive the
+                // shared key. Re-send our CURRENT handshake (same key, so no local
+                // reset) even if we also initiated a cookie chain: after a blackout
+                // both sides commonly initiate at once, so `weInitiated` cannot tell a
+                // request from a reply here. The 2s rate limit bounds duplicate traffic;
+                // the immediate reply cannot bounce because it arrives inside the
+                // limit. This is also the normal lost-reply recovery path.
                 const resyncDue = now - (state.lastResyncHandshakeMs ?? 0) > 2000;
-                if (peerSendingUndecryptable && resyncDue) {
+                if (resyncDue) {
                     state.lastResyncHandshakeMs = now;
-                    state.lastPingRecvMs = now;
                     const reply = createCryptoHandshake({
                         recipientCookie: hs.embeddedCookie,
                         baseNonce: state.ourBaseNonce,
@@ -1759,11 +1788,16 @@ export class Peer {
                         ? Promise.resolve(this.#tcpRelays?.sendOobToFriend(hs.senderDhtPublicKey, reply) ?? 0)
                         : this.#sendPacket(reply, { host: remote.address, port: remote.port });
                     void sendResync()
-                        .then(() => this.#debugLog(`hs_recv duplicate but peer sent undecryptable data — re-sent our handshake to resync friend=${friendId}`))
+                        .then(() => this.#debugLog(`hs_recv duplicate — re-sent our handshake to resync friend=${friendId} ` +
+                        `reason=${peerSendingUndecryptable ? "undecryptable-data" : "duplicate-handshake"}`))
                         .catch((error) => this.#debugLog(`resync handshake failed for ${friendId}: ${error.message}`));
                     return;
                 }
-                state.lastPingRecvMs = now;
+                // A handshake proves reachability, not that this net_crypto session can
+                // decrypt data.  Refreshing lastPingRecvMs here kept a stale session
+                // immortal: the restarted peer retransmitted handshakes every second,
+                // and each retransmit postponed the 32s dead-session breaker forever.
+                // Only successfully decrypted CRYPTO_DATA may refresh liveness.
                 this.#debugVerboseLog(`hs_recv duplicate friend=${friendId} remote=${remote.address}:${remote.port} (session preserved)`);
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.92",
+  "version": "0.1.94",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",