python-aidot-cameras 0.17.1__tar.gz → 0.17.2__tar.gz

{python_aidot_cameras-0.17.1/python_aidot_cameras.egg-info → python_aidot_cameras-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.17.1
+Version: 0.17.2
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT
@@ -178,6 +178,9 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
+| `AIDOT_LOGIN_RETRY_LIMIT` | Consecutive failed LAN logins after which a device is left alone (it is retried again the next time something asks for it). Applies to every device, camera or not - the devices that hit this are lights. | `6` |
+| `AIDOT_LOGIN_RETRY_CAP_S` | Ceiling on the exponential delay between those retries. | `60` |
+| `AIDOT_LOGIN_CONNECT_TIMEOUT_S` | Ceiling on one LAN connect+login attempt. A device that completes the TCP handshake and then stops answering is abandoned and its socket closed rather than parking the attempt forever. | `20` |
 | `AIDOT_LIVESTREAM_PARAM` | **No-op (ignored).** Formerly requested the cloud `liveStreamParam` pre-connect for battery cameras. That call provisions the camera toward AWS KVS, so it sends its media there instead of to this library and the live view negotiates and then shows nothing - and battery cameras were the only ones it applied to. Setting it (or `start_keepalive(live_stream_param=True)`) logs one warning and changes nothing. | ignored |
 
 ### Security hardening

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2}/README.md

@@ -147,6 +147,9 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
+| `AIDOT_LOGIN_RETRY_LIMIT` | Consecutive failed LAN logins after which a device is left alone (it is retried again the next time something asks for it). Applies to every device, camera or not - the devices that hit this are lights. | `6` |
+| `AIDOT_LOGIN_RETRY_CAP_S` | Ceiling on the exponential delay between those retries. | `60` |
+| `AIDOT_LOGIN_CONNECT_TIMEOUT_S` | Ceiling on one LAN connect+login attempt. A device that completes the TCP handshake and then stops answering is abandoned and its socket closed rather than parking the attempt forever. | `20` |
 | `AIDOT_LIVESTREAM_PARAM` | **No-op (ignored).** Formerly requested the cloud `liveStreamParam` pre-connect for battery cameras. That call provisions the camera toward AWS KVS, so it sends its media there instead of to this library and the live view negotiates and then shows nothing - and battery cameras were the only ones it applied to. Setting it (or `start_keepalive(live_stream_param=True)`) logs one warning and changes nothing. | ignored |
 
 ### Security hardening

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2}/aidot_cameras/camera/client.py

@@ -3622,6 +3622,18 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                         self.device_id, _no_media_streak,
                     )
                     self._streaming_active = False
+                    # Same teardown the idle-release exit does. Leaving the
+                    # go2rtc stream registered points it at a serve port with
+                    # nothing listening, so a viewer attaching to a dormant
+                    # camera gets "connection refused" instead of a clean miss -
+                    # exactly what the idle-release path exists to avoid.
+                    self._cancel_keepalive_renew()
+                    try:
+                        await self._deregister_go2rtc()
+                    except Exception:
+                        _LOGGER.debug("camera %s: go2rtc deregister after "
+                                      "abandon failed", self.device_id,
+                                      exc_info=True)
                     return
             if _use_fast and not _healthy and not _fast_failed:
                 _LOGGER.info(

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2}/aidot_cameras/client.py

@@ -72,7 +72,7 @@ from .const import (
     LOGIN_INFO_PERSISTENT_MQTT_LOCK_KEY,
     RUNTIME_ONLY_LOGIN_INFO_KEYS,
 )
-from .device_client import CameraDeviceClient
+from .device_client import CameraDeviceClient, LightDeviceClient
 # CARRIED: drop when python-aidot#6 merges - this is upstream's DeviceStatusData
 # plus the active_color_mode tracker (see aidot_cameras/device_client.py).
 from .device_client import DeviceStatusData as _CarriedStatusData
@@ -791,13 +791,33 @@ class CameraClient(_UpstreamAidotClient):
 
         This is the only place device clients are constructed, upstream or
         here, and therefore the only place that decides which class to use.
-        Non-cameras take the ``super()`` path and get a plain upstream
-        ``DeviceClient``: no camera code RUNS in their path and no camera
-        behavior is attached to them.  (Importing this module still pulls the
-        camera package in - the guarantee is about execution, not imports.)
+        Non-cameras get a ``LightDeviceClient``: upstream's client plus the
+        camera-free ``LanRetryMixin``, and nothing else.  No camera code RUNS in
+        their path and no camera behavior is attached to them.  (Importing this
+        module still pulls the camera package in - the guarantee is about
+        execution, not imports.)
+
+        The light branch is the one place an upstream method body is
+        reproduced.  Upstream's ``get_device_client`` names ``DeviceClient``
+        directly at construction, so there is no seam that lets a subclass be
+        substituted; the alternative is patching upstream's module global, which
+        would reach every consumer in the process rather than only ours.  The
+        one behaviour that copy owes upstream - pushing the discovered LAN IP
+        into the client, without which a light never logs in - is covered by
+        ``test_a_discovered_address_still_reaches_a_light``.  It reads the map
+        through ``CameraDiscover.discovered_device``, which resolves correctly
+        on both upstream shapes (upstream's own line does not).
         """
         if not _is_camera_device(device):
-            device_client = super().get_device_client(device)
+            device_id = device.get(CONF_ID)
+            device_client = self._device_clients.get(device_id)
+            if device_client is None:
+                device_client = LightDeviceClient(device, self.login_info)
+                self._device_clients[device_id] = device_client
+            if self._discover is not None:
+                device_client.update_ip_address(
+                    self._discover.discovered_device.get(device_id)
+                )
             # CARRIED: drop when python-aidot#6 merges
             self._carry_active_color_mode(device_client)
             return device_client

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2}/aidot_cameras/device_client.py

@@ -8,16 +8,22 @@ edited.  This module layers the camera surface on top:
   `CameraDeviceInformation` on them and because the pre-inversion module exposed
   them under these names.  `DeviceInformation` additionally accepts the RAW cloud
   device dict, which upstream's typed constructor does not.
-* `CameraDeviceClient` - `CameraMixin` + upstream `DeviceClient`.  Only the five
-  seams the camera layer actually needs are overridden; no upstream method body
-  is copied.
+* `LightDeviceClient` - upstream `DeviceClient` + `LanRetryMixin` and nothing
+  else.  What every non-camera device gets.  It carries no camera code, by
+  construction: it is declared above the camera import, and the mixin lives in
+  its own camera-free module.
+* `CameraDeviceClient` - `CameraMixin` + `LanRetryMixin` + upstream
+  `DeviceClient`.  Only the seams the camera layer actually needs are
+  overridden; no upstream method body is copied.
 
 Import order matters: the two data classes must be defined BEFORE
 `.camera.client` is imported, because `aidot_cameras.camera.models` imports them
 back from this module at import time.
 """
 
+import asyncio
 import logging
+import os
 from typing import Any, Optional
 
 from aidot.device_client import DeviceClient as _UpstreamDeviceClient
@@ -35,6 +41,20 @@ from ._upstream import (
 )
 from ._upstream import DeviceState as _UpstreamDeviceState
 
+# The LAN retry policy.  It lives in its own module because it is mixed into the
+# plain light client as well as the camera one, and that module must never grow
+# a camera import - see its docstring.  The names are re-exported below, where
+# the policy used to be defined.
+from .lan_retry import (
+    _LOGIN_CONNECT_TIMEOUT_S,
+    _LOGIN_RETRY_BASE_S,
+    _LOGIN_RETRY_CAP_S,
+    _LOGIN_RETRY_LIMIT,
+    LanRetryMixin,
+    _await_connect_with_deadline,
+    _next_login_retry_delay,
+)
+
 from .const import (
     CONF_ATTR,
     CONF_HARDWARE_VERSION,
@@ -55,11 +75,13 @@ from .const import (
 
 _LOGGER = logging.getLogger(__name__)
 
+
 # Upstream's base client, re-exported under its plain name.  `get_device_client`
-# hands one of these back for every non-camera device, so consumers (the Home
-# Assistant integration) need the type to annotate against - and should get it
-# from here rather than importing `aidot` directly, which for them is an
-# undeclared transitive dependency.  This is upstream's class, not a subclass.
+# hands back a `LightDeviceClient` for every non-camera device, which IS one of
+# these, so consumers (the Home Assistant integration) can keep annotating
+# against this name - and should get it from here rather than importing `aidot`
+# directly, which for them is an undeclared transitive dependency.  This name is
+# upstream's class itself, not a subclass.
 DeviceClient = _UpstreamDeviceClient
 
 # Same reasoning for the LAN session state enum: a consumer that wants to know
@@ -146,6 +168,27 @@ class DeviceInformation(_UpstreamDeviceInformation):
                     self.enable_cct = True
 
 
+class LightDeviceClient(LanRetryMixin, _UpstreamDeviceClient):
+    """Upstream's client for every non-camera device, with retries bounded.
+
+    Deliberately declared ABOVE the camera import below, and deliberately not
+    built on anything from `.camera`: this is the class a light gets, and the
+    dispatch seam guarantees no camera code runs in a light's path.  A reader
+    checking that guarantee should be able to see it without leaving this page.
+
+    It exists because the LAN-login storm is a LIGHT problem.  Upstream's
+    unbounded retry and its missing read timeout are defects of the TCP:10000
+    light protocol, and the six devices that produced 15,376 failed logins in
+    one run were lights.  A policy carried only by `CameraDeviceClient` cannot
+    reach them - it is not in their MRO at all - which is exactly how a release
+    shipped claiming the storm was fixed while the log showed 26,229 failures
+    and zero occurrences of either new line.
+
+    Everything else stays upstream's: no method body is copied, and the mixin
+    overrides only the two seams that are defective.
+    """
+
+
 # --------------------------------------------------------------------------- #
 # Camera surface (additive layer)
 # --------------------------------------------------------------------------- #
@@ -177,12 +220,17 @@ from .camera.client import (
 )
 
 
-class CameraDeviceClient(CameraMixin, _UpstreamDeviceClient):
+class CameraDeviceClient(CameraMixin, LanRetryMixin, _UpstreamDeviceClient):
     """Upstream device client with the camera surface mixed in.
 
-    `CameraMixin` comes first in the MRO so camera behavior wins, but the mixin
-    defines none of the upstream connection methods, so every `super()` call
-    below lands on `aidot.device_client.DeviceClient`.
+    `CameraMixin` comes first in the MRO so camera behavior wins; it defines
+    none of the upstream connection methods, so those `super()` calls fall
+    through to `LanRetryMixin` and then to `aidot.device_client.DeviceClient`.
+
+    `LanRetryMixin` is the same policy a light gets - a camera reaching the LAN
+    login path at all is already wrong (see `async_login` below), but if one
+    ever does, it should be bounded by the same rules rather than by a second
+    copy of them.
     """
 
     # Raw JSON of the frame most recently read off the wire, consumed once by
@@ -270,6 +318,8 @@ class CameraDeviceClient(CameraMixin, _UpstreamDeviceClient):
         model = getattr(getattr(self, "info", None), "model_id", "") or ""
         if "IPC" in model:
             return
+        # LanRetryMixin is next in the MRO; it forwards to upstream and clears
+        # the consecutive-failure count on a login that got through.
         await super().async_login()
 
     async def close(self) -> None:

python_aidot_cameras-0.17.2/aidot_cameras/lan_retry.py

@@ -0,0 +1,198 @@
+"""Bounded LAN login retries for every device client, camera or not.
+
+Upstream (`aidot.device_client`) retries a failed TCP:10000 login with no delay
+and no ceiling, and reads the login response with no timeout at all.  Both
+defects belong to the LIGHT protocol; the devices that hit them in the field are
+lights.  So the policy lives here, in a module that imports nothing from
+`aidot_cameras.camera` and never will - `LanRetryMixin` is mixed into the plain
+`LightDeviceClient` as well as into `CameraDeviceClient`, and the dispatch seam's
+guarantee that no camera code RUNS in a light's path has to survive that.
+
+Keeping it in its own module is the enforcement: `device_client` imports the
+camera package at module scope, so anything defined there is one edit away from
+reaching for a camera symbol.  Here, a camera import would be visible on sight.
+"""
+
+import asyncio
+import logging
+import os
+from typing import Optional
+
+_LOGGER = logging.getLogger(__name__)
+
+#: How many consecutive failed LAN logins before this device is left alone, and
+#: the ceiling on the delay between them.  Both overridable per install.
+_LOGIN_RETRY_LIMIT = int(os.environ.get("AIDOT_LOGIN_RETRY_LIMIT", "6"))
+_LOGIN_RETRY_CAP_S = float(os.environ.get("AIDOT_LOGIN_RETRY_CAP_S", "60"))
+_LOGIN_RETRY_BASE_S = 1.0
+
+#: Ceiling on one LAN connect+login attempt.  Upstream has no read timeout at
+#: all - `grep -cE "wait_for|timeout"` over its device_client returns 0 - so a
+#: device that accepts the TCP connection and then stops answering parks
+#: `readexactly(8)` forever, inside `connect()`.
+_LOGIN_CONNECT_TIMEOUT_S = float(
+    os.environ.get("AIDOT_LOGIN_CONNECT_TIMEOUT_S", "20"))
+
+
+async def _await_connect_with_deadline(
+    connect_coro, timeout: float, device_id: str, on_timeout
+) -> bool:
+    """Await a connect attempt, bounded.  True if it finished in time.
+
+    A parked attempt is worse than a failed one.  `connect()`'s
+    `finally: self._connecting = False` never runs, so the client still believes
+    an attempt is in flight - which wedges both re-entry doors, because the
+    retry never spawns and a timer that did fire would hit the in-flight guard
+    and return.  The device stops being managed, silently, and its socket stays
+    open.  Observed: four of six devices ended that way, and all six emitted
+    their single teardown error within 3 ms of each other, one socket having
+    been held for 21 minutes.
+
+    ``on_timeout`` closes the connection.  Its failure is logged and swallowed:
+    this runs on the failure path already, and letting a close error replace the
+    timeout would turn a handled outcome into an unhandled one.  Cancellation of
+    the caller is never swallowed - shutdown has to be able to stop this.
+    """
+    try:
+        await asyncio.wait_for(connect_coro, timeout)
+        return True
+    except asyncio.CancelledError:
+        raise
+    except TimeoutError:  # asyncio.TimeoutError is an alias since 3.11
+        _LOGGER.warning(
+            "%s: LAN connect/login did not answer within %.0fs - abandoning "
+            "this attempt and closing the socket. Override with "
+            "AIDOT_LOGIN_CONNECT_TIMEOUT_S.", device_id, timeout,
+        )
+        try:
+            await on_timeout()
+        except asyncio.CancelledError:
+            raise
+        except Exception:
+            _LOGGER.debug("%s: cleanup after connect timeout failed",
+                          device_id, exc_info=True)
+        return False
+
+
+def _next_login_retry_delay(attempt: int) -> Optional[float]:
+    """Seconds to wait before login attempt ``attempt``, or None to give up.
+
+    Upstream retries a failed login with no delay and no ceiling: ``login()``
+    logs the error, calls ``reset()``, and ``reset()`` ends in
+    ``_schedule_reconnect()``, whose last line is
+    ``asyncio.create_task(self.async_login())`` - straight back into
+    ``connect()``.  The ``loop.call_later(60, ...)`` on the line above never
+    fires, because the next ``reset()`` cancels ``_reconnect_handle`` at its own
+    top.  So the period is the device's login round-trip, not a minute.
+
+    Measured on a live run: 8,434 of 8,434 failures were followed by that
+    device's next connect within a median of 0.295 ms - about 7.6 attempts per
+    second for one light, 15,376 across six devices, sustained until the process
+    ended.  The loop never stops on its own.
+
+    Exponential from 1 s, capped, and then it stops.  The first retry stays
+    prompt because a single dropped connection is ordinary and recovering from
+    it quickly is the behaviour worth keeping; what is not worth keeping is the
+    twelve-thousandth attempt.
+    """
+    if attempt < 0 or attempt >= _LOGIN_RETRY_LIMIT:
+        return None
+    return min(_LOGIN_RETRY_BASE_S * (2 ** attempt), _LOGIN_RETRY_CAP_S)
+
+
+class LanRetryMixin:
+    """Bound the LAN login loop for whatever client this is mixed into.
+
+    Mix it in ahead of `aidot.device_client.DeviceClient`, so every `super()`
+    call below lands on upstream.  Upstream calls `_schedule_reconnect` and
+    `connect` through `self`, so an override here intercepts every path into
+    them, including the `loop.call_later(60, self._schedule_reconnect)` re-arm,
+    whose bound method is resolved through this MRO too.
+
+    Nothing here knows what kind of device it is holding.  That is the point:
+    the six devices that produced the storm were lights, and a policy that only
+    a camera class carries cannot reach them.
+    """
+
+    #: Consecutive failed logins so far.  Class-level so it reads correctly
+    #: before the first failure, and reset on any login that gets through.
+    _login_attempt: int = 0
+
+    #: Ceiling on one connect+login attempt.  A class attribute rather than a
+    #: bare module read so a subclass (or a test) can shorten it in place.
+    _login_connect_timeout_s: float = _LOGIN_CONNECT_TIMEOUT_S
+
+    async def async_login(self) -> None:
+        """Log in, and let a login that got through clear the failure count.
+
+        The ceiling counts CONSECUTIVE failures, so a device that drops
+        occasionally and recovers must never accumulate its way to being
+        abandoned.  Upstream sets `_connect_and_login` only on the success path,
+        which makes it the honest signal to reset against.
+        """
+        await super().async_login()
+        if getattr(self, "_connect_and_login", False):
+            self._login_attempt = 0
+
+    async def connect(self, ip_address) -> None:
+        """Bound the attempt, so a silent device cannot park it forever.
+
+        Upstream reads the login response with no timeout, so a device that
+        completes the TCP handshake and then says nothing leaves this coroutine
+        parked inside `readexactly`, with `_connecting` still True and the
+        socket still open.  See _await_connect_with_deadline.
+
+        On timeout we close through `reset()`, which is also what puts the
+        device back on the retry path - now a bounded one.
+        """
+        ok = await _await_connect_with_deadline(
+            super().connect(ip_address),
+            self._login_connect_timeout_s,
+            getattr(self, "device_id", "?"),
+            self.reset,
+        )
+        if not ok:
+            # reset() cleared it, but the parked attempt never ran connect()'s
+            # own finally, so make the in-flight flag honest either way.
+            self._connecting = False
+
+    def _schedule_reconnect(self) -> None:
+        """Back off between failed logins, and eventually stop.
+
+        Upstream's version re-arms a 60 s timer that never fires and then
+        immediately spawns the next login, so a device that cannot log in is
+        retried at its own round-trip rate forever - measured at ~7.6/s per
+        device, 15,376 attempts in one 25-minute run across six lights.
+
+        This replaces the immediate respawn with an exponential delay and a
+        ceiling.  It deliberately does NOT call super(): the whole of upstream's
+        body is the defect - the timer that never fires and the task that fires
+        at once.
+        """
+        if getattr(self, "_is_close", False):
+            return
+        attempt = getattr(self, "_login_attempt", 0)
+        delay = _next_login_retry_delay(attempt)
+        if delay is None:
+            _LOGGER.warning(
+                "%s: giving up LAN login after %d consecutive failures; it will "
+                "be retried when something asks for this device again. Set "
+                "AIDOT_LOGIN_RETRY_LIMIT to change the ceiling.",
+                getattr(self, "device_id", "?"), attempt,
+            )
+            return
+        self._login_attempt = attempt + 1
+
+        async def _retry() -> None:
+            try:
+                await asyncio.sleep(delay)
+                await self.async_login()
+            except asyncio.CancelledError:
+                raise
+            except Exception:
+                _LOGGER.debug(
+                    "%s: delayed LAN login retry failed",
+                    getattr(self, "device_id", "?"), exc_info=True,
+                )
+
+        self._login_task = asyncio.create_task(_retry())

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-aidot-cameras"
-version = "0.17.1"
+version = "0.17.2"
 description = "Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)"
 readme = "README.md"
 license = "MIT"

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2/python_aidot_cameras.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.17.1
+Version: 0.17.2
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT
@@ -178,6 +178,9 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
+| `AIDOT_LOGIN_RETRY_LIMIT` | Consecutive failed LAN logins after which a device is left alone (it is retried again the next time something asks for it). Applies to every device, camera or not - the devices that hit this are lights. | `6` |
+| `AIDOT_LOGIN_RETRY_CAP_S` | Ceiling on the exponential delay between those retries. | `60` |
+| `AIDOT_LOGIN_CONNECT_TIMEOUT_S` | Ceiling on one LAN connect+login attempt. A device that completes the TCP handshake and then stops answering is abandoned and its socket closed rather than parking the attempt forever. | `20` |
 | `AIDOT_LIVESTREAM_PARAM` | **No-op (ignored).** Formerly requested the cloud `liveStreamParam` pre-connect for battery cameras. That call provisions the camera toward AWS KVS, so it sends its media there instead of to this library and the live view negotiates and then shows nothing - and battery cameras were the only ones it applied to. Setting it (or `start_keepalive(live_stream_param=True)`) logs one warning and changes nothing. | ignored |
 
 ### Security hardening

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2}/python_aidot_cameras.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ aidot_cameras/device_client.py
 aidot_cameras/discover.py
 aidot_cameras/exceptions.py
 aidot_cameras/g711.py
+aidot_cameras/lan_retry.py
 aidot_cameras/py.typed
 aidot_cameras/_vendor/__init__.py
 aidot_cameras/_vendor/aiortc/__init__.py
@@ -113,10 +114,13 @@ tests/test_keepalive_renew.py
 tests/test_key_restart_sdp.py
 tests/test_keyframe_prompter.py
 tests/test_lan_control.py
+tests/test_lan_retry_reaches_the_storming_devices.py
 tests/test_light_active_color_mode.py
 tests/test_live_stream_param.py
 tests/test_live_validate_policy.py
 tests/test_logging_caps.py
+tests/test_login_connect_deadline.py
+tests/test_login_reconnect_backoff.py
 tests/test_media_socket_rcvbuf.py
 tests/test_media_wait_floor.py
 tests/test_motion_poll.py

{python_aidot_cameras-0.17.1 → python_aidot_cameras-0.17.2}/tests/test_dormant_camera_cleanup.py

@@ -63,3 +63,55 @@ def test_real_failures_still_warn():
     assert _classify_ffmpeg_exit(-9, teardown_requested=False) == logging.WARNING
     # ...but an expected teardown is quiet.
     assert _classify_ffmpeg_exit(-9, teardown_requested=True) == logging.DEBUG
+
+
+def test_every_exit_that_stops_streaming_also_deregisters():
+    """Enumerate the exits instead of slicing to one of them.
+
+    The tests above slice from `if _idle_release:` to the end of the source, so
+    they can only ever see that one exit. A second exit was added later - the
+    futile-keepalive abandon - and it returned without deregistering, leaving a
+    dormant camera's stream pointed at a dead serve port. No test could see it,
+    because no test looked anywhere else.
+
+    This walks the function instead: every `return` that follows
+    `self._streaming_active = False` must have a `_deregister_go2rtc` call
+    between the two. It fails on the next exit added carelessly, which the
+    slicing form cannot.
+    """
+    import ast
+    import textwrap
+
+    for name in ("_sdes_keepalive_loop_inner", "_dtls_serve_loop_inner"):
+        tree = ast.parse(textwrap.dedent(_src(name)))
+        fn = tree.body[0]
+
+        stops = []          # (lineno of `_streaming_active = False`)
+        for node in ast.walk(fn):
+            if not isinstance(node, ast.Assign):
+                continue
+            for t in node.targets:
+                if (isinstance(t, ast.Attribute) and t.attr == "_streaming_active"
+                        and isinstance(node.value, ast.Constant)
+                        and node.value.value is False):
+                    stops.append(node.lineno)
+
+        assert stops, f"{name}: no `_streaming_active = False` found at all"
+
+        deregs = [n.lineno for n in ast.walk(fn)
+                  if isinstance(n, ast.Attribute) and n.attr == "_deregister_go2rtc"]
+        returns = [n.lineno for n in ast.walk(fn) if isinstance(n, ast.Return)]
+
+        for stop in stops:
+            # The return that this stop falls through to.
+            after = [r for r in returns if r > stop]
+            if not after:
+                continue        # falls through to the loop, not an exit
+            exit_line = min(after)
+            between = [d for d in deregs if stop < d < exit_line]
+            assert between, (
+                f"{name}: the exit at line {exit_line} sets _streaming_active="
+                f"False (line {stop}) and returns without calling "
+                f"_deregister_go2rtc. A dormant camera's go2rtc stream is left "
+                f"pointing at a serve port with nothing listening."
+            )