@torrent-tv/proxy 2.107.57 → 2.107.58

package/bin/cli.js

@@ -14,6 +14,7 @@
 // for the measurement that made it necessary.
 import "./thread-pool.js";
 import { Command } from "commander";
+import { mkdirSync } from "node:fs";
 import os from "node:os";
 import { spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
@@ -35,6 +36,7 @@ import { collectHealthMetrics } from "../services/transport/health-collector.js"
 import { LOAD_REFRESH_MS, ProxyStateReporter } from "../services/transport/proxy-state.js";
 import { createPortMapper } from "../services/transport/port-mapper.js";
 import { installationId } from "../services/identity/installation-id.js";
+import { PROXY_ROOT } from "../services/encode/LocalObservations.js";
 import { classifyNat } from "../services/transport/nat-classifier.js";
 import { DEFAULT_SEGMENT_FORMAT_ID, SEGMENT_FORMAT_IDS } from "../services/encode/segment-formats/index.js";
 import { logToFile, logger } from "../utils/logger.js";
@@ -100,7 +102,7 @@ program
     "--usrsctp-state",
     "Read usrsctp's association state with gdb when a wedge is declared. OFF by default: gdb attaches to THIS process and stops every thread of it while it works."
   )
-  .option("--memory-bytes <bytes>", "Per-torrent budget for pieces kept in memory before spilling to disk (default 512MB)")
+  .option("--memory-bytes <bytes>", "Per-torrent budget for pieces kept in memory before spilling to disk (default: derived from the memory available when the torrent opens, shared equally between open torrents)")
   .option("--budget <kind>", "How much of this machine the proxy may take: adaptive (default), share or fixed")
   .option("--budget-share <fraction>", "With --budget share: the fraction of what is free, 0..1")
   .option("--budget-bytes <bytes>", "With --budget fixed: the ceiling, per resource")
@@ -109,7 +111,7 @@ program
   .option("--ffmpeg-bin <path>", "Path to ffmpeg binary")
   .option(
     "--state-dir <path>",
-    "Where to keep what this host has measured about itself (default: beside the installed proxy)"
+    "Where to keep this installation's id, what this host has measured about itself, and diagnostic dumps (default: the installed proxy's own directory; pass an empty value to keep nothing)"
   )
   .option(
     "--log-file <path>",
@@ -137,7 +139,19 @@ const bindHost = String(options.host);
 const explicitBaseUrl = options.publicBaseUrl
   ? String(options.publicBaseUrl).replace(/\/+$/, "")
   : "";
-const clientId = installationId({ stateDir: options.stateDir, explicitId: options.id });
+// THE STATE DIRECTORY, resolved once: the one named, the installed proxy's own
+// directory when none is named, or "" when the operator passes an empty value
+// (nothing is kept). Every consumer below is handed this value and none reads
+// the option again.
+const stateDir = options.stateDir === undefined ? PROXY_ROOT : String(options.stateDir);
+if (stateDir) {
+  try {
+    mkdirSync(stateDir, { recursive: true });
+  } catch (error) {
+    logger.warn(`Could not create the state directory ${stateDir}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+const clientId = installationId({ stateDir, explicitId: options.id });
 const clientName = options.name ? String(options.name) : `proxy-${clientId.slice(0, 8)}`;
 const token = String(options.token ?? "");
 const transcodeAudio = options.transcodeAudio !== false;
@@ -347,15 +361,15 @@ async function shutdown(signal) {
 const diagnostics = new Diagnostics({
   logger,
   kinds: [
-    { name: "core dumps", directory: () => options.stateDir || "", matches: (name) => name.startsWith("core.") },
+    { name: "core dumps", directory: () => stateDir, matches: (name) => name.startsWith("core.") },
     {
       name: "heap snapshots",
-      directory: () => options.stateDir || "",
+      directory: () => stateDir,
       matches: (name) => name.endsWith(".heapsnapshot")
     },
     {
       name: "packet captures",
-      directory: () => options.stateDir || "",
+      directory: () => stateDir,
       matches: (name) => name.startsWith("packet-witness")
     }
   ]
@@ -391,7 +405,7 @@ try {
     ffmpegBin,
     memoryBytes,
     segmentFormat: options.segmentFormat,
-    stateDir: options.stateDir,
+    stateDir,
     diagnostics,
     budgetPolicy,
     logFile: options.logFile ?? "",
@@ -444,11 +458,11 @@ try {
   // A native fault writes the whole address space out — 4.18 GB each on the
   // field host, and four of them nearly filled a 235 GB disk. Keep the newest
   // two, which are the evidence for the fault still open, and drop the rest.
-  void pruneCoreDumps(options.stateDir);
+  void pruneCoreDumps(stateDir);
   // Same policy for the packet captures the send-queue witness writes.
   packetWitness = createPacketWitness({
     log: (message) => logger.info(message),
-    dir: options.stateDir || "",
+    dir: stateDir,
     port: actualPort,
     // Evidence takes room from the product, so a capture is asked for rather
     // than taken. Refused, it is a line and not a silence.
@@ -517,8 +531,6 @@ try {
     // read stayed behind the decision to write, so a quiet second costs one
     // call to `process.memoryUsage()`.
     intervalMs: 1_000,
-    quietMs: 60_000,
-    changeBytes: 25 * 1024 * 1024,
     diskPath: os.tmpdir(),
     // WHERE A SNAPSHOT SURVIVES THE PROCESS IT IS ABOUT, and how many are kept
     // — the same answer the torrent worker already had. This scope had neither:
@@ -526,11 +538,8 @@ try {
     // on every restart, and all of them were kept. Fifty-four were written on
     // 2026-09-07 and every one was gone by the time the process that wrote them
     // died of a heap it had never been possible to look at.
-    snapshotDir: options.stateDir || undefined,
+    snapshotDir: stateDir || undefined,
     heapSnapshots: options.heapSnapshots === true,
-    snapshotFloorBytes: 400 * 1024 * 1024,
-    snapshotGrowthBytes: 400 * 1024 * 1024,
-    keepSnapshots: 3
   });
 
   logger.info(`Starting @torrent-tv/proxy v${PROXY_VERSION}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.107.57",
+  "version": "2.107.58",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "repository": {

package/services/encode/LocalObservations.js

@@ -48,6 +48,19 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { configurationKeyOf, kindOfEncoderName } from "./fingerprint.js";
 
+/**
+ * The writer used when none is handed in (a check that only wants the file).
+ * The proxy always hands in the atomic one from `utils/atomic-json.js`, which
+ * this layer may not import.
+ *
+ * @param {string} filePath
+ * @param {unknown} value
+ * @returns {void}
+ */
+function writeInPlace(filePath, value) {
+  writeFileSync(filePath, JSON.stringify(value));
+}
+
 /**
  * The directory of the installed proxy, where these observations are kept when
  * the deployment names no state directory. Deliberately not the working
@@ -84,6 +97,8 @@ export class LocalObservations {
 
   /** @type {{ info: (m: string) => void, warn: (m: string) => void }} */
   #logger;
+  /** @type {(filePath: string, value: unknown) => void} */
+  #writeJson;
 
   /** @type {() => number} */
   #now;
@@ -99,16 +114,19 @@ export class LocalObservations {
    * @param {import("./fingerprint.js").HostFingerprint} params.fingerprint
    * @param {string} params.filePath - Where the readings are kept; empty keeps
    *   them for this process only.
+   * @param {(filePath: string, value: unknown) => void} [params.writeJson] - How
+   *   the file is saved; throws on failure. The atomic writer is handed in.
    * @param {{ info: (m: string) => void, warn: (m: string) => void }} [params.logger]
    * @param {() => number} [params.now]
    */
-  constructor({ fingerprint, filePath, logger = null, now = Date.now }) {
+  constructor({ fingerprint, filePath, writeJson = writeInPlace, logger = null, now = Date.now }) {
     if (!fingerprint || typeof fingerprint !== "object") {
       throw new TypeError("LocalObservations requires the host's fingerprint");
     }
     this.#fingerprint = fingerprint;
     this.#filePath = typeof filePath === "string" ? filePath : "";
     this.#logger = logger ?? { info: () => {}, warn: () => {} };
+    this.#writeJson = writeJson;
     this.#now = now;
   }
 
@@ -367,7 +385,7 @@ export class LocalObservations {
       return;
     }
     try {
-      writeFileSync(this.#filePath, JSON.stringify({ version: FILE_VERSION, entries: this.#entries }));
+      this.#writeJson(this.#filePath, { version: FILE_VERSION, entries: this.#entries });
     } catch (error) {
       // A read-only install keeps what it learned for this process only.
       this.#logger.warn(

package/services/identity/installation-id.js

@@ -1,9 +1,14 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { writeJsonAtomic } from "../../utils/atomic-json.js";
+import { logger } from "../../utils/logger.js";
 
 const ID_FILE = "proxy-identity.json";
 
+/** Ids that could not be written, by identity file: kept so the process keeps one id. */
+const unsavedIds = new Map();
+
 /**
  * Resolve this installation's registry id. Without a state directory the id
  * remains ephemeral; with one, the id survives process restarts.
@@ -27,12 +32,18 @@ export function installationId({ stateDir, explicitId, makeId = randomUUID } = {
     }
   }
 
-  const id = requestedId || savedId || makeId();
+  const id = requestedId || savedId || unsavedIds.get(file) || makeId();
   if (id !== savedId) {
-    mkdirSync(stateDir, { recursive: true });
-    const temporary = `${file}.${process.pid}.tmp`;
-    writeFileSync(temporary, `${JSON.stringify({ id })}\n`, { mode: 0o600 });
-    renameSync(temporary, file);
+    try {
+      mkdirSync(stateDir, { recursive: true });
+      writeJsonAtomic(file, { id }, { mode: 0o600 });
+      unsavedIds.delete(file);
+    } catch (error) {
+      if (unsavedIds.get(file) !== id) {
+        logger.warn(`Cannot save the proxy identity file ${file} (${error.message}); the installation id lasts only until this process exits`);
+      }
+      unsavedIds.set(file, id);
+    }
   }
   return id;
 }

package/services/server/wire-outputs.js

@@ -9,6 +9,7 @@
  */
 
 import { EventEmitter } from "node:events";
+import { writeJsonAtomic } from "../../utils/atomic-json.js";
 import { logger } from "../../utils/logger.js";
 import { KeyframeTables } from "../media/KeyframeTables.js";
 import { bandOf, WaitLedger } from "../encode/OutputWaitLedger.js";
@@ -100,7 +101,7 @@ import { freeBytesFor } from "../storage/free.js";
 import { PlaybackStorageDemand } from "../storage/PlaybackStorageDemand.js";
 import { inputCacheRoot, probeInputCache } from "../encode/input-cache.js";
 import path from "node:path";
-import { contentOf, LocalObservations, PROXY_ROOT } from "../encode/LocalObservations.js";
+import { contentOf, LocalObservations } from "../encode/LocalObservations.js";
 import { configurationKeyOf } from "../encode/fingerprint.js";
 import { qualityStateOf } from "../encode/quality/OutputQualityState.js";
 import { preparedAddresses, watchedAddresses } from "../viewer/watched-addresses.js";
@@ -875,7 +876,9 @@ export function wireOutputs({
   if (calibration?.fingerprint) {
     parts.localObservations = new LocalObservations({
       fingerprint: calibration.fingerprint,
-      filePath: path.join(typeof stateDir === "string" && stateDir.length > 0 ? stateDir : PROXY_ROOT, "local-observations.json"),
+      // The state directory arrives resolved; none keeps the observations in memory only.
+      filePath: typeof stateDir === "string" && stateDir.length > 0 ? path.join(stateDir, "local-observations.json") : "",
+      writeJson: writeJsonAtomic,
       logger
     });
     parts.localObservations.load(calibration.kinds().map((kind) => configurationKeyOf(calibration.fingerprint, {

package/services/storage/files/CompletedFiles.js

@@ -27,6 +27,7 @@ import fs from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
+import { writeJsonAtomic } from "../../../utils/atomic-json.js";
 import { IDLE_KEEP_MS } from "../keep.js";
 
 /**
@@ -541,7 +542,11 @@ export class CompletedFiles {
       await fs.rm(directory, { ...REMOVAL, recursive: true }).catch(() => undefined);
       return;
     }
-    await fs.writeFile(path.join(directory, "manifest.json"), JSON.stringify(named)).catch(() => undefined);
+    try {
+      writeJsonAtomic(path.join(directory, "manifest.json"), named);
+    } catch {
+      // The manifest is a convenience for the next start; a failed write is not a failed keep.
+    }
   }
 
   /** Remove an empty or partial-only directory discovered during startup. */

package/services/storage/memory-report.js

@@ -459,13 +459,13 @@ export function startMemoryReport({
   label = "",
   diskPath = "",
   intervalMs = MEMORY_REPORT_INTERVAL_MS,
-  quietMs = 0,
-  changeBytes = 0,
+  quietMs = 60_000,
+  changeBytes = 25 * 1024 * 1024,
   snapshotDir = "",
   mayKeep = null,
-  snapshotFloorBytes = 500 * 1024 * 1024,
-  snapshotGrowthBytes = 100 * 1024 * 1024,
-  keepSnapshots = 0,
+  snapshotFloorBytes = 400 * 1024 * 1024,
+  snapshotGrowthBytes = 400 * 1024 * 1024,
+  keepSnapshots = 3,
   heapSnapshots = false,
   bufferSnapshotFloorBytes = 0,
   bufferSnapshotGrowthBytes = 500 * 1024 * 1024

package/services/storage/segment-store/SegmentStore.js

@@ -44,6 +44,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync,
 import { rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { writeFileAtomic } from "../../../utils/atomic-json.js";
 
 /** Where every output's segments live. One root for the process. */
 const DEFAULT_STORE_ROOT = path.join(os.tmpdir(), "torrent-tv-hls");
@@ -235,7 +236,7 @@ export class SegmentStore {
       mkdirSync(dir, { recursive: true });
       // What this directory is, for whoever finds it after this process has
       // been killed. Without it the sweep can only throw everything away.
-      writeFileSync(path.join(dir, KEY_FILE), `${key}\n`, "utf8");
+      writeFileAtomic(path.join(dir, KEY_FILE), `${key}\n`);
     }
     this.#touched.set(key, this.#now());
     // Production is about to begin here, and a piece closing in this directory

package/services/torrent/worker/worker.js

@@ -793,20 +793,15 @@ startMemoryReport({
   scope: "thread",
   label: "torrent worker",
   intervalMs: WORKER_MEMORY_SAMPLE_MS,
-  quietMs: 60_000,
-  changeBytes: 25 * 1024 * 1024,
   snapshotDir: workerData?.stateDir || undefined,
   heapSnapshots: workerData?.heapSnapshots === true,
-  snapshotFloorBytes: 400 * 1024 * 1024,
-  snapshotGrowthBytes: 400 * 1024 * 1024,
   // CHOSEN, not derived: no healthy session has recorded this figure yet, so
   // there is no measured normal to stand above. It is set well below the
   // 2.1-4.3 GB the worker held in the minutes before the kills of 2026-10-01,
   // while the machine still has room to write a snapshot. The line prints what the
   // stores hold beside it, which is what a derived floor will come from.
   bufferSnapshotFloorBytes: 500 * 1024 * 1024,
-  bufferSnapshotGrowthBytes: 500 * 1024 * 1024,
-  keepSnapshots: 3
+  bufferSnapshotGrowthBytes: 500 * 1024 * 1024
 });
 
 const STORE_REPORT_INTERVAL_MS = 60_000;

package/utils/atomic-json.js

@@ -0,0 +1,46 @@
+import nodeFs from "node:fs";
+import path from "node:path";
+
+let writes = 0;
+
+/**
+ * Write a file so that a reader (or a restart after a crash) sees either the
+ * previous content or the new content, never a half-written file: the text goes
+ * to a temporary file beside the target, then is renamed over it. Synchronous;
+ * throws on failure and removes its temporary file when it can. It never writes
+ * `filePath` itself.
+ *
+ * @param {string} filePath
+ * @param {string | Uint8Array} data
+ * @param {{ fs?: Partial<typeof nodeFs>, mode?: number }} [options] - `fs`
+ *   overrides individual `node:fs` functions (a check stops the write between
+ *   the two steps with it).
+ * @returns {void}
+ */
+export function writeFileAtomic(filePath, data, { fs = {}, mode } = {}) {
+  const io = { ...nodeFs, ...fs };
+  const temporary = path.join(path.dirname(filePath), `${path.basename(filePath)}.${process.pid}.${++writes}.tmp`);
+  try {
+    io.writeFileSync(temporary, data, mode === undefined ? undefined : { mode });
+    io.renameSync(temporary, filePath);
+  } catch (error) {
+    try {
+      nodeFs.rmSync(temporary, { force: true });
+    } catch {
+      // The write already failed; a temporary file that cannot be removed is the lesser fault.
+    }
+    throw error;
+  }
+}
+
+/**
+ * Serialise `value` as JSON and write it with {@link writeFileAtomic}.
+ *
+ * @param {string} filePath
+ * @param {unknown} value
+ * @param {{ fs?: Partial<typeof nodeFs>, mode?: number }} [options]
+ * @returns {void}
+ */
+export function writeJsonAtomic(filePath, value, options = {}) {
+  writeFileAtomic(filePath, `${JSON.stringify(value)}\n`, options);
+}