@torrent-tv/proxy 2.87.10 → 2.87.11

package/test/worker-channel.test.js

@@ -1,158 +1,158 @@
-/**
- * @file The worker transport's memory contract.
- *
- * These cover the defect that broke playback in 2.9.71-2.9.73: the worker
- * handed the main thread ownership of memory it did not own. WebTorrent's piece
- * cache keeps the buffer it returns and slices it again on the next read, so
- * transferring it detached the cache's own memory and every later read failed
- * with "Cannot perform %TypedArray%.prototype.slice on a detached ArrayBuffer".
- *
- * The field could not tell us this, because the error never reached anyone: the
- * worker sent READ_END from its `finally` before the error was posted, and the
- * main thread had no handler for a read error at all. So a failed read looked
- * exactly like an empty file.
- */
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import { MessageChannel } from "node:worker_threads";
-import { createSendStream, createReceiveStream, createCaller } from "../services/torrent/worker/channel.js";
-
-/**
- * A buffer standing in for one owned by WebTorrent's piece cache: allocated
- * outside Node's shared pool, covering its whole region, and still referenced
- * by its owner after we hand it on.
- *
- * @param {number} size
- * @param {number} fill
- * @returns {Buffer}
- */
-function foreignPiece(size, fill) {
-  const piece = Buffer.allocUnsafeSlow(size);
-  piece.fill(fill);
-  return piece;
-}
-
-test("sending a chunk leaves the source buffer usable by its owner", async () => {
-  const { port1, port2 } = new MessageChannel();
-  try {
-    const sender = createSendStream({ port: port1, requestId: 1 });
-    const piece = foreignPiece(1024 * 1024, 7);
-
-    await sender.send(piece);
-
-    // The owner reads its own buffer again, exactly as the piece cache does on
-    // the next request for the same piece.
-    assert.equal(piece.length, 1024 * 1024, "buffer was detached by the send");
-    assert.equal(piece[0], 7);
-    assert.equal(piece.subarray(0, 16).length, 16, "slicing the source failed");
-  } finally {
-    port1.close();
-    port2.close();
-  }
-});
-
-test("a second read of the same piece still returns its bytes", async () => {
-  const { port1, port2 } = new MessageChannel();
-  try {
-    const piece = foreignPiece(512 * 1024, 3);
-
-    for (const requestId of [1, 2]) {
-      const sender = createSendStream({ port: port1, requestId });
-      await sender.send(piece);
-      sender.end();
-    }
-
-    assert.equal(piece[0], 3, "the piece did not survive being sent twice");
-  } finally {
-    port1.close();
-    port2.close();
-  }
-});
-
-test("chunks arrive with their contents intact", async () => {
-  const { port1, port2 } = new MessageChannel();
-  try {
-    const received = [];
-    // Waited on rather than slept through. This test used to sleep 50 ms and
-    // then assert, so it failed whenever the run was busy — recorded as flaky in
-    // roadmap items 53 and 54, and it failed again on 2026-09-02 for a reason
-    // that shows exactly how little a chosen interval is worth: the worker had
-    // gained one more module to load, and 50 ms stopped being enough.
-    let arrived;
-    const firstChunk = new Promise((resolve) => { arrived = resolve; });
-    port2.on("message", (message) => {
-      if (message?.type === "chunk") {
-        received.push(Buffer.from(message.bytes));
-        arrived();
-      }
-    });
-
-    const sender = createSendStream({ port: port1, requestId: 1 });
-    const piece = foreignPiece(256 * 1024, 42);
-    await sender.send(piece);
-    sender.end();
-
-    await firstChunk;
-    assert.equal(received.length, 1);
-    assert.equal(received[0].length, 256 * 1024);
-    assert.equal(received[0][0], 42);
-    assert.equal(received[0][received[0].length - 1], 42);
-  } finally {
-    port1.close();
-    port2.close();
-  }
-});
-
-test("reads and commands never share a request id", () => {
-  const { port1, port2 } = new MessageChannel();
-  try {
-    const commandIds = [];
-    port2.on("message", (message) => commandIds.push(message.id));
-
-    const caller = createCaller(port1);
-    const readIds = [];
-
-    // Interleaved exactly as the real client does it: commands through `call`,
-    // reads taking an id directly, both over the same channel.
-    for (let round = 0; round < 50; round += 1) {
-      void caller.call("noop", {});
-      readIds.push(caller.nextId());
-    }
-
-    // A repeat between the two sequences is the collision that let a read's
-    // reply resolve a command — with its result, silently.
-    const everyId = [...commandIds, ...readIds];
-    assert.equal(
-      new Set(everyId).size,
-      everyId.length,
-      "an id was handed out to both a command and a read"
-    );
-  } finally {
-    port1.close();
-    port2.close();
-  }
-});
-
-test("a failed read surfaces on the reader instead of ending quietly", async () => {
-  const { port1, port2 } = new MessageChannel();
-  try {
-    const receive = createReceiveStream({
-      port: port1,
-      requestId: 1,
-      onCancel: () => undefined
-    });
-
-    receive.fail(new Error("read failed in the worker"));
-
-    const reader = receive.stream.getReader();
-    await assert.rejects(
-      () => reader.read(),
-      /read failed in the worker/,
-      "the reader saw a clean end instead of the failure"
-    );
-  } finally {
-    port1.close();
-    port2.close();
-  }
-});
+/**
+ * @file The worker transport's memory contract.
+ *
+ * These cover the defect that broke playback in 2.9.71-2.9.73: the worker
+ * handed the main thread ownership of memory it did not own. WebTorrent's piece
+ * cache keeps the buffer it returns and slices it again on the next read, so
+ * transferring it detached the cache's own memory and every later read failed
+ * with "Cannot perform %TypedArray%.prototype.slice on a detached ArrayBuffer".
+ *
+ * The field could not tell us this, because the error never reached anyone: the
+ * worker sent READ_END from its `finally` before the error was posted, and the
+ * main thread had no handler for a read error at all. So a failed read looked
+ * exactly like an empty file.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { MessageChannel } from "node:worker_threads";
+import { createSendStream, createReceiveStream, createCaller } from "../services/torrent/worker/channel.js";
+
+/**
+ * A buffer standing in for one owned by WebTorrent's piece cache: allocated
+ * outside Node's shared pool, covering its whole region, and still referenced
+ * by its owner after we hand it on.
+ *
+ * @param {number} size
+ * @param {number} fill
+ * @returns {Buffer}
+ */
+function foreignPiece(size, fill) {
+  const piece = Buffer.allocUnsafeSlow(size);
+  piece.fill(fill);
+  return piece;
+}
+
+test("sending a chunk leaves the source buffer usable by its owner", async () => {
+  const { port1, port2 } = new MessageChannel();
+  try {
+    const sender = createSendStream({ port: port1, requestId: 1 });
+    const piece = foreignPiece(1024 * 1024, 7);
+
+    await sender.send(piece);
+
+    // The owner reads its own buffer again, exactly as the piece cache does on
+    // the next request for the same piece.
+    assert.equal(piece.length, 1024 * 1024, "buffer was detached by the send");
+    assert.equal(piece[0], 7);
+    assert.equal(piece.subarray(0, 16).length, 16, "slicing the source failed");
+  } finally {
+    port1.close();
+    port2.close();
+  }
+});
+
+test("a second read of the same piece still returns its bytes", async () => {
+  const { port1, port2 } = new MessageChannel();
+  try {
+    const piece = foreignPiece(512 * 1024, 3);
+
+    for (const requestId of [1, 2]) {
+      const sender = createSendStream({ port: port1, requestId });
+      await sender.send(piece);
+      sender.end();
+    }
+
+    assert.equal(piece[0], 3, "the piece did not survive being sent twice");
+  } finally {
+    port1.close();
+    port2.close();
+  }
+});
+
+test("chunks arrive with their contents intact", async () => {
+  const { port1, port2 } = new MessageChannel();
+  try {
+    const received = [];
+    // Waited on rather than slept through. This test used to sleep 50 ms and
+    // then assert, so it failed whenever the run was busy — recorded as flaky in
+    // roadmap items 53 and 54, and it failed again on 2026-09-02 for a reason
+    // that shows exactly how little a chosen interval is worth: the worker had
+    // gained one more module to load, and 50 ms stopped being enough.
+    let arrived;
+    const firstChunk = new Promise((resolve) => { arrived = resolve; });
+    port2.on("message", (message) => {
+      if (message?.type === "chunk") {
+        received.push(Buffer.from(message.bytes));
+        arrived();
+      }
+    });
+
+    const sender = createSendStream({ port: port1, requestId: 1 });
+    const piece = foreignPiece(256 * 1024, 42);
+    await sender.send(piece);
+    sender.end();
+
+    await firstChunk;
+    assert.equal(received.length, 1);
+    assert.equal(received[0].length, 256 * 1024);
+    assert.equal(received[0][0], 42);
+    assert.equal(received[0][received[0].length - 1], 42);
+  } finally {
+    port1.close();
+    port2.close();
+  }
+});
+
+test("reads and commands never share a request id", () => {
+  const { port1, port2 } = new MessageChannel();
+  try {
+    const commandIds = [];
+    port2.on("message", (message) => commandIds.push(message.id));
+
+    const caller = createCaller(port1);
+    const readIds = [];
+
+    // Interleaved exactly as the real client does it: commands through `call`,
+    // reads taking an id directly, both over the same channel.
+    for (let round = 0; round < 50; round += 1) {
+      void caller.call("noop", {});
+      readIds.push(caller.nextId());
+    }
+
+    // A repeat between the two sequences is the collision that let a read's
+    // reply resolve a command — with its result, silently.
+    const everyId = [...commandIds, ...readIds];
+    assert.equal(
+      new Set(everyId).size,
+      everyId.length,
+      "an id was handed out to both a command and a read"
+    );
+  } finally {
+    port1.close();
+    port2.close();
+  }
+});
+
+test("a failed read surfaces on the reader instead of ending quietly", async () => {
+  const { port1, port2 } = new MessageChannel();
+  try {
+    const receive = createReceiveStream({
+      port: port1,
+      requestId: 1,
+      onCancel: () => undefined
+    });
+
+    receive.fail(new Error("read failed in the worker"));
+
+    const reader = receive.stream.getReader();
+    await assert.rejects(
+      () => reader.read(),
+      /read failed in the worker/,
+      "the reader saw a clean end instead of the failure"
+    );
+  } finally {
+    port1.close();
+    port2.close();
+  }
+});

package/utils/client-log-file.js

@@ -1,151 +1,151 @@
-/**
- * @file Where a browser's own log lands: a file beside the proxy's, per session.
- *
- * WHY THIS EXISTS. Both halves of every failure this project investigates live
- * in two places at once — what the proxy did, and what the page saw — and until
- * now the second half went to the SERVER's standard output on the droplet.
- * Every release recreates that container and destroys it. On 2026-09-13 a
- * viewer reported a desync and a frozen picture, and the analysis ran on half
- * the evidence for exactly this reason.
- *
- * Written here instead, next to the proxy's own log, on the same durable
- * directory (`/data` on the addon host). One file per viewing session, named so
- * the two halves join without guessing: the session's start, then the torrent.
- */
-
-import { createWriteStream, mkdirSync, renameSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
-
-/** One file may reach this before it is rotated. */
-const MAX_BYTES = 16 * 1024 * 1024;
-
-/**
- * Make a name safe for a file and short enough to read in a directory listing.
- *
- * Deliberately strict: a torrent name is arbitrary bytes chosen by a stranger,
- * and it is about to become a path.
- *
- * @param {string} value
- * @param {number} max
- * @returns {string}
- */
-function safeName(value, max) {
-  const cleaned = String(value ?? "")
-    .replace(/[^\p{L}\p{N}._-]+/gu, "-")
-    .replace(/-+/g, "-")
-    .replace(/^[-.]+|[-.]+$/g, "");
-  return cleaned.slice(0, max);
-}
-
-/**
- * `2026-09-13T16:05:24.123Z` → `20260913-160524`, which sorts and reads.
- *
- * @param {string} iso
- * @returns {string}
- */
-function stamp(iso) {
-  const when = new Date(iso);
-  const at = Number.isNaN(when.getTime()) ? new Date() : when;
-  const pad = (n) => String(n).padStart(2, "0");
-  return `${at.getUTCFullYear()}${pad(at.getUTCMonth() + 1)}${pad(at.getUTCDate())}` +
-    `-${pad(at.getUTCHours())}${pad(at.getUTCMinutes())}${pad(at.getUTCSeconds())}`;
-}
-
-/**
- * A sink that writes one session's browser lines to its own file.
- *
- * @param {string} proxyLogPath - The proxy's own log file; its directory is
- *   used, so the two halves are always side by side.
- * @returns {{ write: (session: object, lines: string[]) => void, close: () => void }}
- */
-export function createClientLogFiles(proxyLogPath) {
-  const directory = typeof proxyLogPath === "string" && proxyLogPath.length > 0
-    ? dirname(proxyLogPath)
-    : "";
-  /** @type {Map<string, { stream: import("node:fs").WriteStream, path: string, bytes: number }>} */
-  const open = new Map();
-
-  /**
-   * The file for this session, opened on first use.
-   *
-   * Keyed by the session's own id rather than by the name, because the name
-   * gains the torrent the moment one is chosen and the earlier lines — the
-   * page opening, the proxy being chosen, a connection failing — belong to the
-   * same session and must not start a second file.
-   *
-   * @param {{ sessionId: string, startedAt: string, torrentName: string, infoHash: string }} session
-   * @returns {{ stream: import("node:fs").WriteStream, path: string, bytes: number } | null}
-   */
-  function fileFor(session) {
-    if (!directory) return null;
-    const key = session.sessionId;
-    const existing = open.get(key);
-    if (existing) return existing;
-    const film = session.torrentName
-      ? `${safeName(session.torrentName, 60)}-${safeName(session.infoHash, 8)}`
-      : "no-torrent-yet";
-    const path = join(directory, `client-${stamp(session.startedAt)}-${safeName(session.sessionId, 8)}-${film}.log`);
-    try {
-      mkdirSync(directory, { recursive: true });
-      const record = {
-        stream: createWriteStream(path, { flags: "a" }),
-        path,
-        bytes: statSync(path, { throwIfNoEntry: false })?.size ?? 0
-      };
-      // A file that stops being writable must not take the proxy down with it,
-      // and must not be retried on every line.
-      record.stream.on("error", () => open.delete(key));
-      open.set(key, record);
-      return record;
-    } catch {
-      return null;
-    }
-  }
-
-  return {
-    write(session, lines) {
-      const record = fileFor(session);
-      if (!record) return;
-      for (const line of lines) {
-        const text = `${line}\n`;
-        record.bytes += Buffer.byteLength(text);
-        record.stream.write(text);
-      }
-      if (record.bytes >= MAX_BYTES) {
-        try {
-          record.stream.end(() => {
-            try {
-              renameSync(record.path, `${record.path}.1`);
-            } catch {
-              // Renaming a file that has gone leaves nothing to do.
-            }
-          });
-        } catch {
-          // A rotation that cannot happen leaves the file growing, which is
-          // better than losing the session's log to an exception.
-        }
-        open.delete(session.sessionId);
-      }
-    },
-    /**
-     * Finish every open file.
-     *
-     * Awaitable, and that is not a convenience: a write stream opens and
-     * flushes asynchronously, so a process that ends without waiting loses the
-     * last lines of every session — which are the ones a crash is explained by.
-     *
-     * @returns {Promise<void>}
-     */
-    async close() {
-      const ending = [...open.values()].map((record) => new Promise((resolve) => {
-        try {
-          record.stream.end(resolve);
-        } catch {
-          resolve(undefined);
-        }
-      }));
-      open.clear();
-      await Promise.all(ending);
-    }
-  };
-}
+/**
+ * @file Where a browser's own log lands: a file beside the proxy's, per session.
+ *
+ * WHY THIS EXISTS. Both halves of every failure this project investigates live
+ * in two places at once — what the proxy did, and what the page saw — and until
+ * now the second half went to the SERVER's standard output on the droplet.
+ * Every release recreates that container and destroys it. On 2026-09-13 a
+ * viewer reported a desync and a frozen picture, and the analysis ran on half
+ * the evidence for exactly this reason.
+ *
+ * Written here instead, next to the proxy's own log, on the same durable
+ * directory (`/data` on the addon host). One file per viewing session, named so
+ * the two halves join without guessing: the session's start, then the torrent.
+ */
+
+import { createWriteStream, mkdirSync, renameSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/** One file may reach this before it is rotated. */
+const MAX_BYTES = 16 * 1024 * 1024;
+
+/**
+ * Make a name safe for a file and short enough to read in a directory listing.
+ *
+ * Deliberately strict: a torrent name is arbitrary bytes chosen by a stranger,
+ * and it is about to become a path.
+ *
+ * @param {string} value
+ * @param {number} max
+ * @returns {string}
+ */
+function safeName(value, max) {
+  const cleaned = String(value ?? "")
+    .replace(/[^\p{L}\p{N}._-]+/gu, "-")
+    .replace(/-+/g, "-")
+    .replace(/^[-.]+|[-.]+$/g, "");
+  return cleaned.slice(0, max);
+}
+
+/**
+ * `2026-09-13T16:05:24.123Z` → `20260913-160524`, which sorts and reads.
+ *
+ * @param {string} iso
+ * @returns {string}
+ */
+function stamp(iso) {
+  const when = new Date(iso);
+  const at = Number.isNaN(when.getTime()) ? new Date() : when;
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${at.getUTCFullYear()}${pad(at.getUTCMonth() + 1)}${pad(at.getUTCDate())}` +
+    `-${pad(at.getUTCHours())}${pad(at.getUTCMinutes())}${pad(at.getUTCSeconds())}`;
+}
+
+/**
+ * A sink that writes one session's browser lines to its own file.
+ *
+ * @param {string} proxyLogPath - The proxy's own log file; its directory is
+ *   used, so the two halves are always side by side.
+ * @returns {{ write: (session: object, lines: string[]) => void, close: () => void }}
+ */
+export function createClientLogFiles(proxyLogPath) {
+  const directory = typeof proxyLogPath === "string" && proxyLogPath.length > 0
+    ? dirname(proxyLogPath)
+    : "";
+  /** @type {Map<string, { stream: import("node:fs").WriteStream, path: string, bytes: number }>} */
+  const open = new Map();
+
+  /**
+   * The file for this session, opened on first use.
+   *
+   * Keyed by the session's own id rather than by the name, because the name
+   * gains the torrent the moment one is chosen and the earlier lines — the
+   * page opening, the proxy being chosen, a connection failing — belong to the
+   * same session and must not start a second file.
+   *
+   * @param {{ sessionId: string, startedAt: string, torrentName: string, infoHash: string }} session
+   * @returns {{ stream: import("node:fs").WriteStream, path: string, bytes: number } | null}
+   */
+  function fileFor(session) {
+    if (!directory) return null;
+    const key = session.sessionId;
+    const existing = open.get(key);
+    if (existing) return existing;
+    const film = session.torrentName
+      ? `${safeName(session.torrentName, 60)}-${safeName(session.infoHash, 8)}`
+      : "no-torrent-yet";
+    const path = join(directory, `client-${stamp(session.startedAt)}-${safeName(session.sessionId, 8)}-${film}.log`);
+    try {
+      mkdirSync(directory, { recursive: true });
+      const record = {
+        stream: createWriteStream(path, { flags: "a" }),
+        path,
+        bytes: statSync(path, { throwIfNoEntry: false })?.size ?? 0
+      };
+      // A file that stops being writable must not take the proxy down with it,
+      // and must not be retried on every line.
+      record.stream.on("error", () => open.delete(key));
+      open.set(key, record);
+      return record;
+    } catch {
+      return null;
+    }
+  }
+
+  return {
+    write(session, lines) {
+      const record = fileFor(session);
+      if (!record) return;
+      for (const line of lines) {
+        const text = `${line}\n`;
+        record.bytes += Buffer.byteLength(text);
+        record.stream.write(text);
+      }
+      if (record.bytes >= MAX_BYTES) {
+        try {
+          record.stream.end(() => {
+            try {
+              renameSync(record.path, `${record.path}.1`);
+            } catch {
+              // Renaming a file that has gone leaves nothing to do.
+            }
+          });
+        } catch {
+          // A rotation that cannot happen leaves the file growing, which is
+          // better than losing the session's log to an exception.
+        }
+        open.delete(session.sessionId);
+      }
+    },
+    /**
+     * Finish every open file.
+     *
+     * Awaitable, and that is not a convenience: a write stream opens and
+     * flushes asynchronously, so a process that ends without waiting loses the
+     * last lines of every session — which are the ones a crash is explained by.
+     *
+     * @returns {Promise<void>}
+     */
+    async close() {
+      const ending = [...open.values()].map((record) => new Promise((resolve) => {
+        try {
+          record.stream.end(resolve);
+        } catch {
+          resolve(undefined);
+        }
+      }));
+      open.clear();
+      await Promise.all(ending);
+    }
+  };
+}