@steve02081504/fount-p2p 0.0.49 → 0.0.50

package/discovery/nostr/relays.mjs

@@ -103,7 +103,7 @@ let discoveryEnabled = true
 
 /**
  * 规范化 Nostr relay URL（唯一入站入口）。
- * - 仅允许 wss://；`ws://` 仅限回环/私有地址（本地测试/开发）。
+ * - `wss://` 不限地址；`ws://` 只接受本机回环（`localhost` / `::1` / `127.x`），私网与公网一律拒绝。
  * - hostname 小写，去除默认端口，去除尾部斜杠，保留非空 path。
  * @param {unknown} raw 原始 URL
  * @returns {string | null} 规范化字符串，无效返回 null
@@ -250,7 +250,8 @@ function currentTrustedRelayUrls() {
 
 /**
  * 判定该 relay 是否允许作为连接目的地（probe/发布/订阅）。
- * 本机显式配置或 NIP-66 引导集保留信任例外；其余须为公网 hostname 且 DNS 全部解析为公网地址。
+ * 受信 relay（本机显式配置、提供方注册、NIP-66 引导集、pinned，见 [currentTrustedRelayUrls]）不受公网限制；
+ * 其余须为公网 hostname 且 DNS 全部解析为公网地址。
  * @param {string} relayUrl 规范化 relay URL
  * @returns {Promise<boolean>} 允许连接为 true
  */
@@ -261,20 +262,32 @@ export async function isRelayDestinationAllowed(relayUrl) {
 	return relayUrlResolvesPublic(relayUrl)
 }
 
+/**
+ * 最近一次尝试是否失败。时间戳与 lastSuccess 打平按失败算（同一毫秒内的并发尝试里，成功者会记下更晚的时间戳）。
+ * @param {number} lastFailure 最近一次失败时间戳
+ * @param {number} lastSuccess 最近一次成功时间戳
+ * @returns {boolean} 最近一次尝试失败为 true
+ */
+function latestAttemptFailed(lastFailure, lastSuccess) {
+	return lastFailure >= lastSuccess
+}
+
 /**
  * 计算 relay 健康分（越低越优）。
+ * 最近一次尝试失败（或从未成功过）时 RTT 与失败率都取最差值，分数必定高于任何活着的 relay。
  * @param {Partial<RelayPoolEntry>} entry 条目
  * @returns {number} 健康分
  */
 export function computeRelayHealth(entry) {
-	const { rttMs, successCount, failureCount, lastProbe } = entry
-	const total = (successCount || 0) + (failureCount || 0)
-	const failureRate = total > 0 ? (failureCount || 0) / total : 0
-	let rtt = rttMs !== undefined && rttMs !== null ? Number(rttMs) : DEFAULT_RTT_MS
-	if (!Number.isFinite(rtt)) rtt = DEFAULT_RTT_MS
-	rtt = Math.max(1, Math.min(MAX_RTT_MS, rtt))
+	const { rttMs, successCount = 0, failureCount = 0, lastProbe = 0, lastSuccess = 0, lastFailure = 0 } = entry
+	const failed = failureCount > 0 && (!successCount || latestAttemptFailed(lastFailure, lastSuccess))
+	const total = successCount + failureCount
+	const failureRate = failed ? 1 : total > 0 ? failureCount / total : 0
+	// 失败的 relay 最后一次测量已被作废：没有可信 RTT 可依，按上限算。
+	const measuredRtt = failed ? MAX_RTT_MS : rttMs
+	const rtt = Math.max(1, Math.min(MAX_RTT_MS, Number.isFinite(measuredRtt) && measuredRtt > 0 ? measuredRtt : DEFAULT_RTT_MS))
 	let score = rtt * (1 + failureRate * FAILURE_WEIGHT)
-	if (Date.now() - (lastProbe || 0) > PROBE_STALE_MS) score *= STALE_PENALTY
+	if (Date.now() - lastProbe > PROBE_STALE_MS) score *= STALE_PENALTY
 	return score
 }
 
@@ -512,7 +525,7 @@ export function recordProbeSuccess(url, rttMs) {
 	const entry = ensureEntry(normalized)
 	if (rttMs != null && Number.isFinite(Number(rttMs))) entry.rttMs = Math.max(0, Math.min(MAX_RTT_MS, Math.round(Number(rttMs))))
 	entry.successCount++
-	entry.lastSuccess = entry.lastProbe = entry.lastSeen = Date.now()
+	entry.lastSuccess = entry.lastProbe = entry.lastSeen = Math.max(Date.now(), entry.lastProbe + 1)
 	markDirty()
 }
 
@@ -525,7 +538,8 @@ export function recordProbeFailure(url) {
 	if (!normalized) return
 	const entry = ensureEntry(normalized)
 	entry.failureCount++
-	entry.lastFailure = entry.lastProbe = entry.lastSeen = Date.now()
+	entry.rttMs = null
+	entry.lastFailure = entry.lastProbe = entry.lastSeen = Math.max(Date.now(), entry.lastProbe + 1)
 	markDirty()
 }
 
@@ -583,17 +597,23 @@ export function clearStale() {
 }
 
 /**
- * @returns {RelayPoolEntry[]} 工作集（健康分升序，含全部 pinned）
+ * @returns {RelayPoolEntry[]} 工作集（保留未探测引导项，排除失败或过期项，优先 pinned）
  */
 export function getWorkingRelays() {
-	const sorted = sortByHealth([...poolEntries.values()])
+	const now = Date.now()
+	// 合格项：最近一次尝试成功且没过期，或压根还没探测过的引导项。
+	const eligible = [...poolEntries.values()].filter(entry =>
+		entry.successCount === 0
+			? entry.lastFailure === 0
+			: !latestAttemptFailed(entry.lastFailure, entry.lastSuccess) && now - entry.lastSuccess <= PROBE_STALE_MS)
+	const sorted = sortByHealth(eligible)
 	const pinned = sorted.filter(isPinned)
 	const rest = sorted.filter(entry => !isPinned(entry))
 	return dedupeByUrl([...pinned, ...rest.slice(0, Math.max(0, WORKING_RELAYS_COUNT - pinned.length))])
 }
 
 /**
- * @returns {RelayPoolEntry[]} 监听/发布子集（含全部 public/manual）
+ * @returns {RelayPoolEntry[]} 监听/发布子集（仅含工作集内 public/manual）
  */
 export function getListenRelays() {
 	const working = getWorkingRelays()

package/discovery/nostr/selection.mjs

@@ -12,7 +12,6 @@ import {
 import {
 	computeRelayHealth,
 	getPeerRoute,
-	getPinnedRelays,
 	getPoolByUrl,
 	getWorkingRelays,
 	recordPublishResult,
@@ -116,7 +115,7 @@ export function expandFromHistory(nodeHash, base, limit) {
 
 /**
  * 计算到指定节点的当前轮路由目标集。
- * Round 0：对端声称前4（无则本机工作集前4，再空则 pinned）。
+ * Round 0：对端声称前4（无则本机工作集前4）。
  * Round ≥1：历史成功 + 对端综合分补足 + 加权采样，附退避；总扇出封顶。
  * @param {string} nodeHash 目标节点
  * @param {number} attempt 当前尝试轮次（0 起）
@@ -139,7 +138,6 @@ export function handshakeTargets(nodeHash, attempt) {
 			for (const entry of working.slice(0, ROUND0_TARGET_COUNT)) push(entry.url)
 			return
 		}
-		for (const url of getPinnedRelays().slice(0, ROUND0_TARGET_COUNT)) push(url)
 	}
 	if (attempt <= 0) {
 		round0()

package/docs/nostr_relay_discovery.md

@@ -16,8 +16,10 @@ Source layout (`discovery/nostr/`):
 
 `relayPool` (all known) → `workingRelays` (top-`WORKING_RELAYS_COUNT` by health) → `listenRelays` (top-`LISTEN_RELAYS_COUNT` working subset used for publish/listen).
 
-- `public`/`manual` entries are **pinned**: always in `working`/`listen` and never evicted by `clearStale` or pool-cap. Pin count may exceed the nominal caps.
+- `public`/`manual` entries are **pinned**: preferred in `working`/`listen` when eligible and never evicted by `clearStale` or pool-cap. Failed or stale pins remain in the pool for retry, but leave the working/listen sets. Pin count may exceed the nominal caps.
 - `nip66`/`peer` entries are disposable: evicted when stale (`PROBE_STALE_MS`) or when the pool exceeds `POOL_CAP`.
+- A relay leaves the working/listen sets when it is **not eligible**: never probed but already failed, or its latest attempt failed, or its last success is older than `PROBE_STALE_MS`. Untested bootstrap entries stay eligible; exclusion never evicts from the pool, so dead relays keep getting retried.
+- Configured `relayUrls` override the automatic listen subset; adverts publish this resolved subscription set as `listenNostrRelays`.
 - Fresh nodes are seeded with `DEFAULT_RELAY_URLS` (`source: 'public'`) so `listenRelays` is never empty at cold start.
 - Persistent connections stay bounded by `workingRelays` (`WORKING_RELAYS_COUNT`, max 32); pins influence selection, not simultaneous connections.
 
@@ -25,20 +27,22 @@ Source layout (`discovery/nostr/`):
 
 `normalizeNostrRelayUrl` (in `relays.mjs`) is the only entry for every inbound URL (NIP-66 `d` tag, manual config, peer advert):
 
-- `wss://` always; `ws://` only for loopback/private hosts (local dev/tests).
+- `wss://` to any host; `ws://` to loopback only (`localhost` / `::1` / `127.x` — local dev/tests). Private and public `ws://` are rejected outright.
+- `isRelayDestinationAllowed` then gates dialling: a **trusted** relay (local config, provider registration, the NIP-66 bootstrap set, or any pinned `public`/`manual` entry) may be private; every other relay must be a public hostname whose DNS resolves entirely to public addresses. So a private `wss://` is only reachable when something pinned or configured it.
 - hostname lowercased, default port removed, trailing slashes removed, non-empty path kept.
 - Invalid → `null` → dropped with an audit log (`nodeDebug('invalidRelayUrl', { url, reason })`), never silently cleaned.
 
 ## Health score
 
 ```text
-failureRate = failureCount / (successCount + failureCount)
-rtt         = clamp(rttMs ?? DEFAULT_RTT_MS, 1, MAX_RTT_MS)
-score       = rtt * (1 + failureRate * FAILURE_WEIGHT)     // FAILURE_WEIGHT = 4
-score      *= STALE_PENALTY                                 // ×2 if lastProbe older than PROBE_STALE_MS
+dead        = latest attempt failed, or the entry never succeeded   // ties count as failed
+failureRate = dead ? 1 : failureCount / (successCount + failureCount)
+rtt         = clamp(dead ? MAX_RTT_MS : rttMs, 1, MAX_RTT_MS)      // DEFAULT_RTT_MS when unknown, zero or invalid
+score       = rtt * (1 + failureRate * FAILURE_WEIGHT)             // FAILURE_WEIGHT = 4
+score      *= STALE_PENALTY                                        // ×2 if lastProbe older than PROBE_STALE_MS
 ```
 
-Lower is better. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishResult` share the same counters. Writes to `nodeDir/nostr/relays.json` are **throttled** (2s debounce).
+Lower is better. A dead entry (`failureCount > 0` and either no successes or a latest failure) scores with `MAX_RTT_MS`, `failureRate = 1`, and its stale RTT discarded, so it can never outrank a live one. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishResult` share the same counters; attempt timestamps advance monotonically so success/failure ordering survives same-millisecond attempts. Writes to `nodeDir/nostr/relays.json` are **throttled** (2s debounce).
 
 ## Persistence
 
@@ -74,7 +78,7 @@ Lower is better. `recordProbeSuccess` / `recordProbeFailure` / `recordPublishRes
 
 `handshakeTargets(nodeHash, attempt)`:
 
-- **Round 0**: peer-claimed `listenRelays` top 4 by composite score (own health + peer rtt); else local `workingRelays` top 4; else pinned top 4.
+- **Round 0**: peer-claimed `listenRelays` top 4 by composite score (own health + peer rtt); else local `workingRelays` top 4. Empty working sets do not fall back to failed pins.
 - **Round ≥1**: backoff `min(2000 · 2^(attempt−1), 60000)`; base on `lastGoodNostrRelays` (expanded via `expandFromHistory` ≤ 16), or weighted-random sample of `workingRelays` (weight `1/score`); round-0 core always included; fanout capped at `MAX_ROUTING_FANOUT` (64).
 - Retries ≤ `MAX_ROUTING_ATTEMPTS` (4).
 

package/link/providers/webrtc.mjs

@@ -142,6 +142,7 @@ export async function createWebRtcLink(options) {
 	let bulkChannel = null
 	let unlistenRemote = null
 	let sendQueues = null
+	let linkReady = false
 	let controlLowEvents = 0
 	let bulkLowEvents = 0
 	let reconnectCount = 0
@@ -216,6 +217,8 @@ export async function createWebRtcLink(options) {
 			}
 		},
 	})
+	// 数据链路是否已完成握手认证：完成后，发不出去的重协商答复不该再拆掉这条活链路。
+	void pipe.ready.then(() => { linkReady = true }, () => { })
 
 	/**
 	 * @param {RTCDataChannel} channel RTC 数据通道
@@ -420,11 +423,18 @@ export async function createWebRtcLink(options) {
 					candidates: localCandidateCount,
 					hasCandidates,
 				})
-				await sendSignal({
-					type: 'description',
-					rung: rungIndex,
-					description: peerConnection.localDescription?.toJSON?.() ?? peerConnection.localDescription ?? answer,
-				})
+				try {
+					await sendSignal({
+						type: 'description',
+						rung: rungIndex,
+						description: peerConnection.localDescription?.toJSON?.() ?? peerConnection.localDescription ?? answer,
+					})
+				}
+				catch (error) {
+					// 已认证的数据链路不应被后续信令发送失败关闭。
+					if (!linkReady) throw error
+					nodeDebug('p2p:webrtc answer signal send failed after link ready', { reason: formatErrorReason(error) })
+				}
 				await pipe.maybeSendAuth()
 			}
 			return

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@steve02081504/fount-p2p",
-	"version": "0.0.49",
+	"version": "0.0.50",
 	"description": "fount federation P2P layer — link, trust graph, mailbox, DAG, EVFS.",
 	"keywords": [
 		"network",

package/transport/runtime_bootstrap.mjs

@@ -15,7 +15,7 @@ import {
 	createNostrDiscoveryProvider,
 	resolveNostrRelayUrls,
 } from '../discovery/nostr/index.mjs'
-import { getListenRelays, getWorkingRelays, loadRelayPool, startNostrRelayDiscovery } from '../discovery/nostr/relays.mjs'
+import { getWorkingRelays, loadRelayPool, startNostrRelayDiscovery } from '../discovery/nostr/relays.mjs'
 import { createBleGattLinkProvider } from '../link/providers/ble_gatt.mjs'
 import {
 	listLinkProviders,
@@ -188,7 +188,7 @@ export function createRuntimeBootstrap(deps) {
 						.filter(entry => entry.rttMs != null)
 						.slice(0, MAX_ADVERT_RELAY_POOL)
 						.map(entry => ({ url: entry.url, rttMs: entry.rttMs })),
-					listen: getListenRelays().map(entry => entry.url),
+					listen: resolveNostrRelayUrls(),
 				}
 				: { pool: [], listen: [] },
 		)