v4.5.4

changelog.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2026-03-15 - 4.5.4 - fix(remoteingress-core)
+preserve stream close ordering and add flow-control stall timeouts
+
+- Send CLOSE and CLOSE_BACK frames on the data channel so they arrive after the final stream data frames.
+- Log and abort stalled upload and download paths when flow-control windows stay empty for 120 seconds.
+- Apply a 60-second timeout when writing buffered stream data to the upstream connection to prevent hung streams.
+
 ## 2026-03-15 - 4.5.3 - fix(remoteingress-core)
 prioritize control frames over data in edge and hub tunnel writers
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/remoteingress",
-  "version": "4.5.3",
+  "version": "4.5.4",
   "private": false,
   "description": "Edge ingress tunnel for DcRouter - accepts incoming TCP connections at network edge and tunnels them to DcRouter SmartProxy preserving client IP via PROXY protocol v1.",
   "main": "dist_ts/index.js",

rust/crates/remoteingress-core/src/edge.rs

@@ -703,13 +703,17 @@ async fn handle_client_connection(
     // Task: client -> hub (upload direction) with per-stream flow control
     let mut buf = vec![0u8; 32768];
     loop {
-        // Wait for send window to have capacity
+        // Wait for send window to have capacity (with stall timeout)
         loop {
             let w = send_window.load(Ordering::Acquire);
             if w > 0 { break; }
             tokio::select! {
                 _ = window_notify.notified() => continue,
                 _ = client_token.cancelled() => break,
+                _ = tokio::time::sleep(Duration::from_secs(120)) => {
+                    log::warn!("Stream {} upload stalled (window empty for 120s)", stream_id);
+                    break;
+                }
             }
         }
         if client_token.is_cancelled() { break; }
@@ -737,10 +741,10 @@ async fn handle_client_connection(
         }
     }
 
-    // Send CLOSE frame via control channel (only if not cancelled)
+    // Send CLOSE frame via DATA channel (must arrive AFTER last DATA for this stream)
     if !client_token.is_cancelled() {
         let close_frame = encode_frame(stream_id, FRAME_CLOSE, &[]);
-        let _ = tunnel_ctrl_tx.try_send(close_frame);
+        let _ = tunnel_data_tx.try_send(close_frame);
     }
 
     // Cleanup

rust/crates/remoteingress-core/src/hub.rs

@@ -537,8 +537,16 @@ async fn handle_edge_connection(
                                                         match data {
                                                             Some(data) => {
                                                                 let len = data.len() as u32;
-                                                                if up_write.write_all(&data).await.is_err() {
-                                                                    break;
+                                                                match tokio::time::timeout(
+                                                                    Duration::from_secs(60),
+                                                                    up_write.write_all(&data),
+                                                                ).await {
+                                                                    Ok(Ok(())) => {}
+                                                                    Ok(Err(_)) => break,
+                                                                    Err(_) => {
+                                                                        log::warn!("Stream {} write to upstream timed out (60s)", stream_id);
+                                                                        break;
+                                                                    }
                                                                 }
                                                                 // Track consumption for flow control
                                                                 consumed_since_update += len;
@@ -568,13 +576,17 @@ async fn handle_edge_connection(
                                         // with per-stream flow control (check send_window before reading)
                                         let mut buf = vec![0u8; 32768];
                                         loop {
-                                            // Wait for send window to have capacity
+                                            // Wait for send window to have capacity (with stall timeout)
                                             loop {
                                                 let w = send_window.load(Ordering::Acquire);
                                                 if w > 0 { break; }
                                                 tokio::select! {
                                                     _ = window_notify.notified() => continue,
                                                     _ = stream_token.cancelled() => break,
+                                                    _ = tokio::time::sleep(Duration::from_secs(120)) => {
+                                                        log::warn!("Stream {} download stalled (window empty for 120s)", stream_id);
+                                                        break;
+                                                    }
                                                 }
                                             }
                                             if stream_token.is_cancelled() { break; }
@@ -603,10 +615,10 @@ async fn handle_edge_connection(
                                             }
                                         }
 
-                                        // Send CLOSE_BACK to edge (only if not cancelled)
+                                        // Send CLOSE_BACK via DATA channel (must arrive AFTER last DATA_BACK)
                                         if !stream_token.is_cancelled() {
                                             let close_frame = encode_frame(stream_id, FRAME_CLOSE_BACK, &[]);
-                                            let _ = writer_tx.try_send(close_frame);
+                                            let _ = data_writer_tx.try_send(close_frame);
                                         }
 
                                         writer_for_edge_data.abort();
@@ -616,10 +628,10 @@ async fn handle_edge_connection(
 
                                     if let Err(e) = result {
                                         log::error!("Stream {} error: {}", stream_id, e);
-                                        // Send CLOSE_BACK on error (only if not cancelled)
+                                        // Send CLOSE_BACK via DATA channel on error (must arrive after any DATA_BACK)
                                         if !stream_token.is_cancelled() {
                                             let close_frame = encode_frame(stream_id, FRAME_CLOSE_BACK, &[]);
-                                            let _ = writer_tx.try_send(close_frame);
+                                            let _ = data_writer_tx.try_send(close_frame);
                                         }
                                     }
 

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/remoteingress',
-  version: '4.5.3',
+  version: '4.5.4',
   description: 'Edge ingress tunnel for DcRouter - accepts incoming TCP connections at network edge and tunnels them to DcRouter SmartProxy preserving client IP via PROXY protocol v1.'
 }