@torrent-tv/proxy 2.48.0 → 2.49.0

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 2.49.0
+
+- **Fix**: The torrent worker is allowed to END rather than being torn down under itself. A core dump read on 2026-08-21 named the fault the proxy has been dying of: `SIGSEGV` in `v8::Value::IsArrayBufferView` reached through `napi_get_buffer_info` from utp-native's `on_utp_accept`, called from its UDP read — all of it inside `node::Environment::CleanupHandles`, under `FreeEnvironment`, on `Worker::Run`. That is a teardown race, not a data fault, which is why neither patch our forked library already carries touched it: a datagram arriving while the environment is being freed walks into an isolate that no longer exists. `destroyAll` called `Worker.terminate()` immediately after destroying the client inside, and `terminate()` frees the environment with libuv's handle callbacks still queued. It now waits for the thread to exit by itself — once the client is destroyed nothing holds its loop open — with `terminate()` kept as a five-second fallback, because a shutdown that hangs is worse than one that is forced.
+- **New**: A worker thread that ends is noticed. Only `message` and `error` were listened for, so when the thread went away the proxy simply stopped and the log ended mid-sentence — five times in three days with not one line to say so, and no way to tell our own shutdown from the thread dying. An `exit` handler now says which of the two it was, and fails everything waiting rather than leaving it hanging.
+- **New**: Core dumps are capped at the newest two at startup. Each is the worker's whole address space — 4.18 GB on the field host — and four of them had nearly filled a 235 GB disk. The newest stay because they are the evidence for the fault still open. `dumpsToRemove` is pure and tested.
+
 ## 2.48.0
 
 - **Fix**: A copied picture now begins where it was asked to, so its cuts land on the times its playlist names. ffmpeg's own CLI moves an input seek back by `3*AV_TIME_BASE / 23` — **130.435 ms** — whenever the container does not declare `AVFMT_SEEK_TO_PTS` (Matroska does not) and a stream carries B-frames, which is sound in itself: such containers seek in decode order while the caller asks in presentation order. The consequence for a copy is that asking for a keyframe lands on the one BEFORE it, deterministically; and since `-segment_times` is measured from where the run really began while this code computed those offsets from the time it asked for, every cut of the run inherited one whole keyframe interval. Field 2026-08-20: 119 of 125 segments arriving a uniform 2.002 s early against the 0.5 s hls.js bridges, so every fragment was refused and re-fetched — on 2026-08-17 two of them 1908 times each. The request is now made that much later, bounded by half the distance to the next keyframe. Measured 2026-08-21 on Matroska with keyframes every 2 s: `-ss 10` produced a first segment starting at 8.000, `-ss 10.130435` one starting at 10.000; on MP4, where the heuristic does not fire, 10, 10.130435 and 10.2 all produced 10.000 — right in one case and harmless in the other. Not applied when the picture is re-encoded: a re-encode discards frames up to the requested time and already begins exactly there (`-ss 11` copied starts at 10.000, re-encoded at 11.000).

package/bin/cli.js

@@ -23,6 +23,7 @@ import { registerClient } from "../services/registry-api.js";
 import { createTunnelClient } from "../services/tunnel-client.js";
 import { createWebRtcManager } from "../services/webrtc-manager.js";
 import { createDataChannelHandler } from "../services/data-channel-handler.js";
+import { pruneCoreDumps } from "../services/core-dumps.js";
 import { collectHealthMetrics } from "../services/health-collector.js";
 import { createPortMapper } from "../services/port-mapper.js";
 import { classifyNat } from "../services/nat-classifier.js";
@@ -294,6 +295,11 @@ try {
   actualPort = started.port;
   const directBaseUrl = explicitBaseUrl || `http://${bindHost}:${actualPort}`;
 
+  // A native fault writes the whole address space out — 4.18 GB each on the
+  // field host, and four of them nearly filled a 235 GB disk. Keep the newest
+  // two, which are the evidence for the fault still open, and drop the rest.
+  void pruneCoreDumps(options.stateDir);
+
   logger.info(`Starting @torrent-tv/proxy v${PROXY_VERSION}`);
   logger.info(`Local stream endpoint: http://${bindHost}:${actualPort}/stream`);
   logger.info(`Advertised direct URL: ${directBaseUrl}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.48.0",
+  "version": "2.49.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/core-dumps.js

@@ -0,0 +1,106 @@
+/**
+ * @file Keep the last few core dumps and no more.
+ *
+ * A native fault on the torrent worker writes the whole address space out: on
+ * the field host that is **4.18 GB each**, and four of them had nearly filled a
+ * 235 GB disk by 2026-08-21. The dumps are worth having — the one read that day
+ * named a fault three days of reasoning had not — but only the recent ones are,
+ * and a full disk costs more than an old dump is worth.
+ *
+ * Deliberately not "delete them all": the newest are the evidence for the fault
+ * that is still open (roadmap item 7).
+ */
+
+import { readdir, rm, stat } from "node:fs/promises";
+import path from "node:path";
+
+import { logger } from "../utils/logger.js";
+
+/** How many to keep, newest first. */
+export const CORE_DUMPS_KEPT = 2;
+
+/**
+ * Which dumps to remove, given what is there.
+ *
+ * Pure, so the rule can be tested without a filesystem: newest first by the
+ * time they were written, keep `keep`, name the rest.
+ *
+ * @param {Array<{ name: string, writtenAt: number }>} dumps
+ * @param {number} [keep]
+ * @returns {string[]} Names to delete, oldest first.
+ */
+export function dumpsToRemove(dumps, keep = CORE_DUMPS_KEPT) {
+  const sorted = [...(Array.isArray(dumps) ? dumps : [])]
+    .filter((dump) => typeof dump?.name === "string" && Number.isFinite(dump?.writtenAt))
+    .sort((left, right) => right.writtenAt - left.writtenAt);
+  return sorted.slice(Math.max(0, keep)).map((dump) => dump.name).reverse();
+}
+
+/**
+ * Whether a file name is a core dump this host wrote.
+ *
+ * The kernel's pattern on the addon host produces `core.<thread>.<pid>.<epoch>`
+ * — every one seen so far is `core.WorkerThread.81.…`, the thread the torrent
+ * client runs on. Matched loosely on the `core.` prefix so a differently
+ * configured host is still swept.
+ *
+ * @param {string} name
+ * @returns {boolean}
+ */
+export function isCoreDump(name) {
+  return typeof name === "string" && /^core\.[^/\\]+$/.test(name);
+}
+
+/**
+ * Delete all but the newest few core dumps in `dir`.
+ *
+ * Best-effort and never fatal: a proxy that cannot tidy its dumps still has to
+ * serve video.
+ *
+ * @param {string} dir
+ * @param {number} [keep]
+ * @returns {Promise<void>}
+ */
+export async function pruneCoreDumps(dir, keep = CORE_DUMPS_KEPT) {
+  if (typeof dir !== "string" || dir.length === 0) {
+    return;
+  }
+  /** @type {Array<{ name: string, writtenAt: number, bytes: number }>} */
+  const dumps = [];
+  try {
+    for (const name of await readdir(dir)) {
+      if (!isCoreDump(name)) {
+        continue;
+      }
+      try {
+        const info = await stat(path.join(dir, name));
+        if (info.isFile()) {
+          dumps.push({ name, writtenAt: info.mtimeMs, bytes: info.size });
+        }
+      } catch {
+        // silent-ok: it went away between listing and reading, which is the
+        // outcome this function wanted anyway.
+      }
+    }
+  } catch {
+    return; // No such directory, or unreadable. Nothing to tidy.
+  }
+  if (dumps.length === 0) {
+    return;
+  }
+  const doomed = dumpsToRemove(dumps, keep);
+  const freed = dumps
+    .filter((dump) => doomed.includes(dump.name))
+    .reduce((total, dump) => total + dump.bytes, 0);
+  for (const name of doomed) {
+    try {
+      await rm(path.join(dir, name), { force: true });
+    } catch {
+      // silent-ok: best effort, and the next start tries again.
+    }
+  }
+  logger.info(
+    `core dumps: ${dumps.length} present, keeping the newest ${Math.min(keep, dumps.length)}` +
+      (doomed.length > 0 ? `, removed ${doomed.length} (${(freed / 1e9).toFixed(2)} GB)` : "")
+  );
+}

package/services/torrent-worker/client.js

@@ -22,6 +22,15 @@ import { createCaller, createReceiveStream } from "./channel.js";
 import { Command, Event } from "./protocol.js";
 
 const WORKER_URL = new URL("./worker.js", import.meta.url);
+/**
+ * How long a shutdown waits for the thread to end by itself before forcing it.
+ *
+ * Ending by itself is what lets libuv drain the handle callbacks it is holding;
+ * forcing it is what ran one of those against a freed isolate. Five seconds is
+ * long enough for a destroyed torrent client to release its sockets and short
+ * enough that a shutdown never appears to hang.
+ */
+const WORKER_EXIT_GRACE_MS = 5_000;
 
 /**
  * Runs the torrent client on its own thread and exposes it to the main thread.
@@ -34,6 +43,12 @@ const WORKER_URL = new URL("./worker.js", import.meta.url);
  */
 export class TorrentWorkerClient {
   #worker;
+  /**
+   * Whether this shutdown was asked for, so the thread ending can be told from
+   * the thread dying. Without it both look identical from outside, which is how
+   * five crashes produced no line in the log.
+   */
+  #stopping = false;
   #caller;
   /** Receive-side handles for in-flight reads, keyed by request id. */
   #reads = new Map();
@@ -186,6 +201,30 @@ export class TorrentWorkerClient {
       }
       this.#reads.clear();
     });
+
+    // A worker that ENDS was, until now, not noticed at all: only `message` and
+    // `error` were listened for. So when the thread went away the proxy simply
+    // stopped, the log ended mid-sentence, and nothing said whether we had
+    // asked for it — which is precisely the reading that was missing on
+    // 2026-08-21, when a core dump showed the thread faulting inside
+    // `Environment::CleanupHandles` and there was no way to tell our own
+    // shutdown from the thread ending on its own.
+    this.#worker.on("exit", (code) => {
+      if (this.#stopping) {
+        logger.info(`torrent-worker: thread ended as asked (code ${code})`);
+        return;
+      }
+      logger.error(
+        `torrent-worker: thread ended on its own with code ${code} — nobody asked it to. ` +
+        "Everything waiting on it is failed; the proxy has no torrent client until it is rebuilt."
+      );
+      const reason = new Error("Torrent worker ended unexpectedly.");
+      this.#caller.rejectAll(reason);
+      for (const [, read] of this.#reads) {
+        read.fail(reason);
+      }
+      this.#reads.clear();
+    });
   }
 
   /**
@@ -520,11 +559,33 @@ export class TorrentWorkerClient {
    * @returns {Promise<void>}
    */
   async destroyAll() {
+    this.#stopping = true;
     try {
       await this.#caller.call(Command.DESTROY_ALL, {});
     } catch {
-      // Already gone — termination below is what matters.
+      // Already gone — the wait below settles either way.
     }
-    await this.#worker.terminate();
+    // Let the thread END rather than tearing it down under itself.
+    //
+    // `terminate()` frees the environment immediately, with the handle
+    // callbacks libuv still holds queued. One of those is utp-native's UDP
+    // read, and running it against a freed isolate is what the core dump of
+    // 2026-08-21 caught: `on_utp_accept` → `napi_get_buffer_info` →
+    // `v8::Value::IsArrayBufferView` inside `Environment::CleanupHandles`.
+    // Once the client inside is destroyed the thread has nothing left holding
+    // its loop open, so it exits by itself and the callbacks drain first.
+    //
+    // `terminate()` stays as the bounded fallback, because a shutdown that
+    // hangs is worse than one that is forced.
+    await new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        logger.warn("torrent-worker: thread did not end in 5s; terminating it");
+        void this.#worker.terminate().finally(resolve);
+      }, WORKER_EXIT_GRACE_MS);
+      this.#worker.once("exit", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
   }
 }

package/test/core-dumps.test.js

@@ -0,0 +1,57 @@
+/**
+ * @file Keep the last few core dumps and no more.
+ *
+ * Each is the worker thread's whole address space — 4.18 GB on the field host —
+ * and four of them had nearly filled a 235 GB disk by 2026-08-21. The newest
+ * are evidence for a fault that is still open, so they stay; the rest go.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { dumpsToRemove, isCoreDump } from "../services/core-dumps.js";
+
+const dumps = [
+  { name: "core.WorkerThread.81.1787176646", writtenAt: 1787176646000 },
+  { name: "core.WorkerThread.81.1787224562", writtenAt: 1787224562000 },
+  { name: "core.WorkerThread.81.1787237468", writtenAt: 1787237468000 },
+  { name: "core.WorkerThread.81.1787243278", writtenAt: 1787243278000 },
+  { name: "core.WorkerThread.81.1787292750", writtenAt: 1787292750000 }
+];
+
+test("the newest two stay and the rest go, oldest first", () => {
+  assert.deepEqual(dumpsToRemove(dumps), [
+    "core.WorkerThread.81.1787176646",
+    "core.WorkerThread.81.1787224562",
+    "core.WorkerThread.81.1787237468"
+  ]);
+});
+
+test("fewer than the limit leaves everything alone", () => {
+  assert.deepEqual(dumpsToRemove(dumps.slice(0, 2)), []);
+  assert.deepEqual(dumpsToRemove([]), []);
+});
+
+test("order on disk does not decide; the time written does", () => {
+  const shuffled = [dumps[3], dumps[0], dumps[4], dumps[2], dumps[1]];
+  assert.deepEqual(dumpsToRemove(shuffled, 1), [
+    "core.WorkerThread.81.1787176646",
+    "core.WorkerThread.81.1787224562",
+    "core.WorkerThread.81.1787237468",
+    "core.WorkerThread.81.1787243278"
+  ]);
+});
+
+test("only core dumps are considered", () => {
+  assert.equal(isCoreDump("core.WorkerThread.81.1787292750"), true);
+  assert.equal(isCoreDump("proxy.log"), false);
+  assert.equal(isCoreDump("host-timings.json"), false);
+  // Not a path, and not a directory called core.
+  assert.equal(isCoreDump("core.foo/bar"), false);
+  assert.equal(isCoreDump(""), false);
+});
+
+test("nothing readable is not a reason to delete anything", () => {
+  assert.deepEqual(dumpsToRemove(null), []);
+  assert.deepEqual(dumpsToRemove([{ name: 5, writtenAt: "x" }]), []);
+});