Drop duplicate MQTT packets when the same packet hash arrives at the
same observer with the same hop count within 120s. Increase TimescaleDB
max_connections to 300 to prevent connection exhaustion on startup.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add server-side multi-observer resolver that solves a shared backbone
once (anchor observer), then constrains other observers to reuse the
same nodes for shared path hash prefixes, branching only at divergence
- New GET /api/path-beta/resolve-multi endpoint returns consistent
per-observer results in a single request
- Relax corridor filtering for multi-observer packets: candidates
accepted if within ANY observer's corridor, not just the primary
- Strengthen observer hop hint weights (0.09→0.18 confirmed,
0.11→0.22 reachable, 0.10→0.20 fallback) for better cross-observer
candidate steering
- Enumerate permutations from fork point for divergent suffixes
- Frontend prefers multi endpoint when 2+ observers, with cache
keyed by sorted observer IDs for automatic invalidation on new
observations
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Extract and persist routeType from wire header byte (was always undefined)
- Log warnings on truncated path data and reserved hash-size modes
- Guard buildCompatRawHex against pathByteLength > 63 overflow
- Extract transport codes (4 bytes) when present in FLOOD/DIRECT+codes packets
- Validate path hash hex lengths against wire-format hash size in resolver
- Add routeType to LivePacket type for downstream consumers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- getOwnerNodeIdsForUsername/getMappedOwnerNodeIds: move dedup and format
validation into SQL (SELECT DISTINCT + regex filter) instead of JS post-processing
- viableLinksCache: add setInterval to evict stale entries every 30s so unused
network/observer combos don't persist in memory indefinitely
- /owner/live: add 5s in-memory cache per nodeId to avoid 6 heavy parallel
DB queries on every poll cycle
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers to all responses
- Cap express.json() body to 50kb to prevent memory exhaustion via large payloads
- Redact credentials from MQTT broker URL before logging (ws://user:pass@host pattern)
- Whitelist telemetry event kind field instead of accepting arbitrary strings
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Enforce OWNER_COOKIE_SECRET env var — throw on startup if unset rather than
falling back to a weak derived secret
- Fix HTTPS detection to use exact string match instead of .includes()
- Cap and validate MQTT login credentials (32 char max, username format regex)
- Validate packetHash query param as hex before hitting the path resolver
- Validate node ID path params as 64-char hex in /nodes/:id/links and /nodes/:id/history
- Bound viableLinksCache to 50 entries with oldest-first eviction
- Bound countedAdvertHashes to 10,000 entries with oldest-first eviction
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Resolver now picks shortest-hop observation (ORDER BY hop_count ASC) instead of
most recent arrival, matching what the live feed shows for flooding packets
- Red path segments that share an edge with any purple (high-confidence) path are
filtered out so purple always takes visual precedence
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- usePacketPathOverlay: don't cache null beta predictions; re-fetch pinned
packet paths when new observers arrive after pin
- MapView: stable linkedNodesKey fingerprint so linkLines memo only recomputes
when linked node positions/roles change, not on every heartbeat
- health/status + api/routes: exclude test-network-only nodes from stale count
and mqttNodes stat so they don't inflate thresholds
- mosquitto/acl: add meshcore-test/# readwrite for backend user
- useNodes/PacketFeed/App: merge rx_count/tx_count from DB, ALL badge when all
MQTT regions hear a packet, improved summary extraction
- db/index: getRecentPackets now deduplicates by packet_hash with observer
aggregation; getLastNPackets adds rx_count/tx_count and _summary support
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- move beta path resolution onto the backend with packet-level diagnostics and live API access
- add path simulation worker plumbing, health/schema updates, and compose wiring
- update app overlays to fetch server-computed beta paths with animated rendering and request caching
- refine mobile controls so map layers collapse behind a toggle and compact the links legend
Ben