fix(relay): replace active stall probe with passive inbound watchdog

The previous stall watchdog issued a periodic NIP-01 REQ ("are you
still there?") and treated a missing EOSE as a stalled socket. That
write is the trigger for a much worse failure on Warp / VPN-asleep
half-open sockets: the tauri-plugin-websocket `send` command holds
the global connection-manager mutex across the underlying
`poll_flush`, so a probe parked on a dead socket blocks every
subsequent `connect` from registering its writer in the map. The
replacement socket's read loop never starts → no AUTH challenge ever
reaches JS → 8s AUTH timeout → reset → repeat forever. We've
reproduced this as the WARP wedge.

Remove the active probe entirely. Track inbound activity instead:
`recordInbound()` is called from `handleWsMessage` for every frame
(including relay heartbeat pings, which are observable as Channel
messages even when not surfaced as nostr-protocol payloads). After
60s with no inbound frame at all we declare a stall and call back
into the client, which tears down the socket so the existing
reconnect path runs. The watchdog itself performs zero writes,
which means it cannot trigger the plugin wedge it's trying to
detect.

A deterministic Playwright regression in
`desktop/tests/e2e/relay-reconnect.spec.ts` simulates the plugin
symptom directly by hanging `plugin:websocket|send` in the e2e
bridge and verifies the watchdog does not write into the half-open
socket while reconnect proceeds.

Signed-off-by: Tyler Longwell <109685178+tlongwell-block@users.noreply.github.com>
Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>

Author: 3 people

desktop/playwright.config.ts

@@ -24,6 +24,7 @@ export default defineConfig({
         "**/channel-browser.spec.ts",
         "**/messaging.spec.ts",
         "**/mentions.spec.ts",
+        "**/relay-reconnect.spec.ts",
         "**/workflows.spec.ts",
       ],
       use: {

desktop/src/shared/api/relayClientSession.ts

@@ -35,23 +35,11 @@ const RECONNECT_BASE_DELAY_MS = 1_000,
   EVENT_BATCH_MS = 16;
 
 /**
- * Application-level liveness probe.
- *
- * Tungstenite auto-pongs and the OS keeps the TCP socket open, so a
- * half-open WS (Warp's orange-icon state, an asleep VPN, etc.) presents as
- * "fully connected" to the WS layer indefinitely — no Close, no Error.
- *
- * We work around that by periodically sending a cheap NIP-01 `REQ` with
- * `limit: 0` and waiting for the matching `EOSE`. A single missed probe
- * (no EOSE within `STALL_PROBE_TIMEOUT_MS`) — or a send-side failure on the
- * probe itself — flips state to `stalled` and force-resets the socket so
- * the existing reconnect path runs.
- *
- * The filter intentionally matches nothing real so the relay only ever
- * answers with EOSE.
+ * Passive liveness check. The relay sends heartbeat pings every 30s; if no
+ * inbound frame arrives for two heartbeat windows, treat the socket as stalled.
  */
-const STALL_PROBE_INTERVAL_MS = 20_000;
-const STALL_PROBE_TIMEOUT_MS = 10_000;
+const STALL_CHECK_INTERVAL_MS = 10_000;
+const STALL_IDLE_TIMEOUT_MS = 60_000;
 
 export class RelayClient {
   private wsId: number | null = null;
@@ -90,9 +78,8 @@ export class RelayClient {
 
   private connectionStateEmitter = new RelayConnectionStateEmitter("idle");
   private stallWatchdog = new RelayStallWatchdog({
-    intervalMs: STALL_PROBE_INTERVAL_MS,
-    probeTimeoutMs: STALL_PROBE_TIMEOUT_MS,
-    sendRaw: (payload) => this.sendRaw(payload),
+    intervalMs: STALL_CHECK_INTERVAL_MS,
+    idleTimeoutMs: STALL_IDLE_TIMEOUT_MS,
     onStall: (error) => {
       this.connectionStateEmitter.set("stalled");
       this.resetConnection(error);
@@ -692,6 +679,7 @@ export class RelayClient {
 
   private async handleWsMessage(message: unknown, generation: number) {
     if (generation !== this.connectionGeneration) return;
+    this.stallWatchdog.recordInbound();
 
     if (
       typeof message === "object" &&
@@ -813,12 +801,6 @@ export class RelayClient {
   }
 
   private handleEose(subId: string) {
-    if (this.stallWatchdog.handleEose(subId)) {
-      // Probe round-trip succeeded — silently CLOSE the sub.
-      void this.closeSubscription(subId).catch(() => {});
-      return;
-    }
-
     const subscription = this.subscriptions.get(subId);
     if (!subscription) {
       return;

desktop/src/shared/api/relayStallWatchdog.test.mjs

@@ -3,123 +3,104 @@ import test from "node:test";
 
 import { RelayStallWatchdog } from "./relayStallWatchdog.ts";
 
-// Shim `window` to expose the timer + crypto APIs the watchdog uses. The
-// real RelayClient runs in a Tauri WebView where `window` exists; under
-// node:test we wire it to the same globals.
+// Shim `window` to expose the timer APIs the watchdog uses. The real
+// RelayClient runs in a Tauri WebView where `window` exists; under node:test we
+// wire it to the same globals.
 if (typeof globalThis.window === "undefined") {
   globalThis.window = {
     setInterval: (...args) => setInterval(...args),
     clearInterval: (id) => clearInterval(id),
-    setTimeout: (...args) => setTimeout(...args),
-    clearTimeout: (id) => clearTimeout(id),
   };
 }
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
 function makeWatchdog(overrides = {}) {
-  const sends = [];
   const stalls = [];
+  let now = overrides.now ?? 1;
   const wd = new RelayStallWatchdog({
-    intervalMs: overrides.intervalMs ?? 30,
-    probeTimeoutMs: overrides.probeTimeoutMs ?? 30,
-    sendRaw:
-      overrides.sendRaw ??
-      (async (payload) => {
-        sends.push(payload);
-      }),
+    intervalMs: overrides.intervalMs ?? 20,
+    idleTimeoutMs: overrides.idleTimeoutMs ?? 50,
     onStall: (err) => {
       stalls.push(err);
     },
-    now: overrides.now,
+    now: () => now,
   });
-  return { wd, sends, stalls };
+  return {
+    advance: (ms) => {
+      now += ms;
+    },
+    setNow: (value) => {
+      now = value;
+    },
+    stalls,
+    wd,
+  };
 }
 
-test("first probe carries the expected NIP-01 REQ shape", async () => {
-  const { wd, sends } = makeWatchdog();
+test("does not send probes while watching for stalls", async () => {
+  const { wd } = makeWatchdog();
   wd.start();
-  // Wait until a probe is observed.
-  for (let i = 0; i < 50 && sends.length === 0; i++) await sleep(5);
+  await sleep(45);
   wd.stop();
-  assert.equal(sends.length, 1);
-  const [verb, subId, filter] = sends[0];
-  assert.equal(verb, "REQ");
-  assert.match(subId, /^probe-/);
-  assert.deepEqual(filter.kinds, [9999]);
-  assert.equal(filter.limit, 0);
-  assert.ok(typeof filter.since === "number");
+  // The passive watchdog has no send callback by construction. This test is a
+  // regression guard for the WARP bug: liveness checks must not write to a
+  // socket already suspected of being half-open.
+  assert.equal(typeof wd.recordInbound, "function");
 });
 
-test("EOSE for the current probe clears in-flight + lets the next probe fire", async () => {
-  const { wd, sends, stalls } = makeWatchdog();
+test("idle timeout without inbound frames triggers onStall", async () => {
+  const { advance, stalls, wd } = makeWatchdog();
   wd.start();
-  for (let i = 0; i < 50 && sends.length === 0; i++) await sleep(5);
-  const firstSubId = sends[0][1];
-  // Resolve the probe.
-  assert.equal(wd.handleEose(firstSubId), true);
-  // Within the next interval+probe window, another probe should fire.
-  for (let i = 0; i < 50 && sends.length < 2; i++) await sleep(5);
+  advance(60);
+  for (let i = 0; i < 20 && stalls.length === 0; i++) await sleep(5);
   wd.stop();
-  assert.ok(sends.length >= 2, `expected ≥2 probes, got ${sends.length}`);
-  assert.equal(stalls.length, 0, "no stall expected when EOSE arrives");
-});
-
-test("EOSE for a non-probe subId returns false", () => {
-  const { wd } = makeWatchdog();
-  assert.equal(wd.handleEose("live-abc"), false);
+  assert.equal(stalls.length, 1);
+  assert.match(stalls[0].message, /no inbound frames/i);
 });
 
-test("timeout without EOSE triggers onStall", async () => {
-  const { wd, stalls } = makeWatchdog();
+test("inbound frames reset the idle timer", async () => {
+  const { advance, stalls, wd } = makeWatchdog({ idleTimeoutMs: 50 });
   wd.start();
-  // intervalMs (30) before first send + probeTimeoutMs (30) — wait a bit
-  // past their sum.
-  for (let i = 0; i < 50 && stalls.length === 0; i++) await sleep(10);
+  advance(40);
+  wd.recordInbound();
+  advance(40);
+  await sleep(30);
+  assert.equal(
+    stalls.length,
+    0,
+    "recent inbound frame should keep socket alive",
+  );
+  advance(20);
+  for (let i = 0; i < 20 && stalls.length === 0; i++) await sleep(5);
   wd.stop();
-  assert.ok(stalls.length >= 1, "expected at least one stall");
-  assert.match(stalls[0].message, /stalled/i);
+  assert.equal(stalls.length, 1);
 });
 
-test("send-side failure triggers onStall immediately", async () => {
-  const { wd, stalls } = makeWatchdog({
-    sendRaw: async () => {
-      throw new Error("ws is dead");
-    },
-  });
-  wd.start();
-  for (let i = 0; i < 50 && stalls.length === 0; i++) await sleep(5);
-  wd.stop();
-  assert.ok(stalls.length >= 1, "expected stall on send failure");
-  assert.match(stalls[0].message, /ws is dead/);
+test("recordInbound is ignored while stopped", async () => {
+  const { advance, stalls, wd } = makeWatchdog({ idleTimeoutMs: 50 });
+  wd.recordInbound();
+  advance(100);
+  await sleep(30);
+  assert.equal(stalls.length, 0);
 });
 
-test("stop() cancels a pending stall timeout", async () => {
-  const { wd, sends, stalls } = makeWatchdog();
+test("stop() cancels the idle check", async () => {
+  const { advance, stalls, wd } = makeWatchdog({ idleTimeoutMs: 50 });
   wd.start();
-  for (let i = 0; i < 50 && sends.length === 0; i++) await sleep(5);
-  // Probe is in-flight; stop before it can time out.
   wd.stop();
-  // Wait well past the timeout window.
-  await sleep(80);
-  assert.equal(stalls.length, 0, "stop() should cancel the pending stall");
+  advance(100);
+  await sleep(35);
+  assert.equal(stalls.length, 0);
 });
 
 test("start() is idempotent — does not create duplicate intervals", async () => {
-  const { wd, sends } = makeWatchdog({ intervalMs: 25, probeTimeoutMs: 200 });
+  const { advance, stalls, wd } = makeWatchdog({ idleTimeoutMs: 50 });
   wd.start();
   wd.start();
   wd.start();
-  // Allow one probe to fire and resolve it so the *next* probe can fire if
-  // the interval was somehow doubled.
-  for (let i = 0; i < 50 && sends.length === 0; i++) await sleep(5);
-  wd.handleEose(sends[0][1]);
-  // Within one more interval window, exactly one more probe should fire
-  // (not two), which is the contract for `start()` being idempotent.
-  await sleep(45);
+  advance(60);
+  for (let i = 0; i < 20 && stalls.length === 0; i++) await sleep(5);
   wd.stop();
-  assert.ok(
-    sends.length <= 2,
-    `expected ≤2 probes despite triple-start(), got ${sends.length}`,
-  );
+  assert.equal(stalls.length, 1);
 });