@torrent-tv/proxy 2.9.40 → 2.9.41

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2.9.41
+
+- **Fix**: A malformed or v2-only torrent source no longer crashes the whole proxy in a restart loop. WebTorrent's `Torrent._onTorrentId` does `arr2hex(parsedTorrent.infoHash)` assuming a BitTorrent v1 infohash exists; a v2-only / hybrid magnet (or a corrupt source) parses with `infoHash === undefined`, so that becomes `Buffer.from(undefined)` and throws in a microtask that bypasses the client `error` event — taking down the node and every viewer on it (observed: `ERR_INVALID_ARG_TYPE` → tunnel reconnect loop; the WebRTC session died ~6 s in as the process restarted under it). Two fixes: the torrent-add path now **pre-validates the infohash** with `parse-torrent` and rejects a source without a valid v1 40-hex infohash as a clean error the browser can show; and the process gained a **last-resort `uncaughtException`/`unhandledRejection` guard** that logs the full stack and keeps serving, so no single bad torrent can ever crash-loop the proxy. NOT a regression from the download-performance work (2.9.40) — those paths don't touch torrent parsing; it is a pre-existing crash surfaced by an unusual source.
+- **New**: Longer idle retention so a brief absence resumes instead of restarting. The HLS transcode session idle TTL is raised from 2 min to **10 min** and the torrent-data idle TTL from 5 min to **15 min**. A viewer who pauses, backgrounds the tab, or turns the phone off for a few minutes now resumes without a cold ffmpeg restart and without re-downloading already-fetched data — the warm session also widens the seamless auto-reconnect window. An idle ffmpeg stops producing at the look-ahead cap, so the longer session TTL costs retained segments on disk rather than sustained CPU; the global disk cap still evicts torrent data earlier under pressure, and active playback keeps refreshing both timers so neither expires mid-watch.
+
 ## 2.9.40
 
 - **New**: Adaptive upload throttle. Seeding to the BitTorrent swarm does not help our viewer (we deliver over our own channel) — it is pure uplink cost and the riskiest legal act — so the client-wide upload limit now defaults to **off** (`throttleUpload(0)`, was WebTorrent's unlimited default) and is raised only when needed. A 5 s adjuster sets: **0** when no file has an active reader (stop seeding entirely once nothing is being watched); a low **floor** (50 KB/s) while a reader is active (a token upload so tit-for-tat does not choke us to zero); and a **boost** (512 KB/s) only when a torrent is starving (download barely trickling while it still needs data) AND its wires show reciprocity choke (≥2 peers we want data from are choking us) — earning unchoke slots to un-starve the download. The policy is a pure function (`decideUploadLimit`, unit-tested); each change is logged for field tuning. Client-wide limit (one active torrent is the norm today).

package/bin/cli.js

@@ -26,6 +26,22 @@ import { logger } from "../utils/logger.js";
 const require = createRequire(import.meta.url);
 const { version: PROXY_VERSION } = require("../package.json");
 
+// Last-resort process guard. This proxy runs UNTRUSTED torrents through
+// WebTorrent, which can throw ASYNCHRONOUSLY on a malformed source — e.g. a
+// v2-only / hybrid magnet crashes `arr2hex(parsedTorrent.infoHash)` deep inside
+// `Torrent._onTorrentId` (undefined v1 infohash), in a microtask that bypasses
+// the client "error" event. Without this, one bad torrent takes down the whole
+// node and every viewer on it, and the addon restarts in a crash loop. Log the
+// full stack and keep serving: the offending session fails on its own; everyone
+// else is unaffected. (The add path also pre-validates the infohash, so this is
+// a backstop for anything not caught there.)
+process.on("uncaughtException", (error) => {
+  logger.error(`uncaughtException (kept alive): ${error?.stack ?? error}`);
+});
+process.on("unhandledRejection", (reason) => {
+  logger.error(`unhandledRejection (kept alive): ${reason instanceof Error ? reason.stack : String(reason)}`);
+});
+
 const program = new Command();
 
 const HELP_EXAMPLES = `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.9.40",
+  "version": "2.9.41",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/hls-session-manager.js

@@ -55,10 +55,13 @@ const SEEK_SETTLE_MS = 1_200;
 // burst, so a still-moving scrubber cannot delay a genuine seek forever.
 const SEEK_SETTLE_MAX_MS = 2_500;
 // Idle TTL: a session is disposed this long after the last segment/playlist
-// access. Kept short so an ffmpeg process does not keep burning CPU after the
-// viewer stops or navigates away. Active playback refreshes the timer on every
-// segment fetch, so it never expires mid-watch.
-const DEFAULT_SESSION_TTL_MS = 120 * 1000;
+// access. Long enough that a viewer who pauses, backgrounds the tab, or briefly
+// turns the phone off can resume WITHOUT a cold ffmpeg restart (the warm session
+// also backs the seamless auto-reconnect). ffmpeg stops producing at the
+// look-ahead cap when idle, so a lingering session costs retained segments on
+// disk, not sustained CPU. Active playback refreshes the timer on every segment
+// fetch, so it never expires mid-watch.
+const DEFAULT_SESSION_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_STARTUP_WAIT_MS = 5_000;
 // Realtime budget — runtime downswitch (software encoder only). Periodically
 // check each active software-transcode session's ffmpeg `speed`; when it stays

package/services/torrent-pool.js

@@ -11,6 +11,7 @@ import os from "node:os";
 import path from "node:path";
 import { rmSync, statfsSync } from "node:fs";
 import WebTorrent from "webtorrent";
+import parseTorrent from "parse-torrent";
 import { logger } from "../utils/logger.js";
 
 // WebTorrent's default download root (see webtorrent lib/torrent.js: TMP =
@@ -20,9 +21,11 @@ const WEBTORRENT_STORE_ROOT = path.join(os.tmpdir(), "webtorrent");
 
 // How long a torrent may sit with zero active file readers before it is
 // removed (with its on-disk store). Generous so brief gaps between ffmpeg
-// range reads — or a short pause — do not evict an in-use torrent; a longer
-// idle (viewer gone) frees the disk. Re-requesting re-adds (re-downloads) it.
-const TORRENT_IDLE_TTL_MS = 300_000;
+// range reads — a pause, a backgrounded tab, or a phone turned off for a few
+// minutes — do not evict an in-use torrent's already-downloaded data, so a
+// resume plays from disk instead of re-downloading. A longer idle (viewer truly
+// gone) frees the disk; the global disk cap still evicts earlier under pressure.
+const TORRENT_IDLE_TTL_MS = 15 * 60 * 1000;
 
 // Bytes ahead of a read position to mark CRITICAL on each range request. In
 // WebTorrent, `critical` does NOT reorder the sequential piece scan — it enables
@@ -424,6 +427,26 @@ export class TorrentPool {
     }
 
     const torrentId = decodeTorrentSource(sourceType, source);
+
+    // Pre-validate the infohash BEFORE handing the source to WebTorrent.
+    // WebTorrent's Torrent._onTorrentId does `arr2hex(parsedTorrent.infoHash)`
+    // assuming a BitTorrent v1 infohash exists; a v2-only / hybrid magnet (or a
+    // malformed source) parses with `infoHash === undefined`, so that call does
+    // `Buffer.from(undefined)` and throws in a microtask that bypasses the
+    // client "error" event — crashing the whole process. Reject cleanly here so
+    // the browser gets an error it can show, and the proxy stays up.
+    let parsed;
+    try {
+      parsed = await parseTorrent(torrentId);
+    } catch {
+      parsed = null;
+    }
+    if (!parsed || typeof parsed.infoHash !== "string" || !/^[0-9a-f]{40}$/i.test(parsed.infoHash)) {
+      throw new Error(
+        "Unsupported torrent source: no BitTorrent v1 infohash (v2-only or malformed torrents are not supported)."
+      );
+    }
+
     const promise = new Promise((resolve, reject) => {
       const onError = (error) => {
         this.client.off("error", onError);