fix(peers): derive peer role from capabilities instead of hardcoding Entry

Every registration site (exit accept/connect, auto exit accept/connect,
relay connector) was hardcoding NodeRole::Entry for the peer. Now uses
peer_role_from_capabilities() which checks the handshake: both
listen+connect → Relay, tun_capable → Entry, otherwise → Exit.

Moved role_from_capabilities to mode/mod.rs as
peer_role_from_capabilities so all modes share it.

Relay connector now resolves the peer handshake to get the peer's
name and capabilities — no more showing raw address as peer name.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: maxholman

crates/daemon/src/mode/auto.rs

@@ -465,6 +465,9 @@ async fn run_auto_connect_session_dispatch(
                 peer_hs.name,
             );
             node_state.update_role(NodeRole::Exit);
+            let peer_role = peer_hs
+                .capabilities
+                .map_or(NodeRole::Exit, super::peer_role_from_capabilities);
             let peer_name = if peer_hs.name.is_empty() {
                 peer_addr.to_string()
             } else {
@@ -495,6 +498,7 @@ async fn run_auto_connect_session_dispatch(
                 instructions_rx,
                 responses_tx,
                 heartbeat,
+                peer_role,
                 &peer_name,
                 peer_addr,
                 &metrics,
@@ -551,6 +555,7 @@ async fn run_auto_exit_session_inner(
     instructions_rx: tokio::sync::mpsc::Receiver<wallhack_wire::data::EntryNodeInstruction>,
     responses_tx: tokio::sync::mpsc::Sender<wallhack_wire::data::ExitNodeResponse>,
     _heartbeat: tokio::task::JoinHandle<()>,
+    peer_role: NodeRole,
     peer_name: &str,
     peer_addr: &str,
     metrics: &Arc<Metrics>,
@@ -559,7 +564,7 @@ async fn run_auto_exit_session_inner(
     peers.register(
         peer_name.to_string(),
         peer_addr.to_string(),
-        NodeRole::Entry,
+        peer_role,
         ConnectionSide::Connect,
     );
 
@@ -1037,12 +1042,15 @@ async fn run_auto_accept_session_inner(
             } else {
                 peer_hs.name.clone()
             };
-            // The peer connected to us (we accepted), so side=Accept.
-            // We are exit, so the peer that connected is entry.
+            let peer_role = peer_hs
+                .capabilities
+                .as_ref()
+                .copied()
+                .map_or(NodeRole::Exit, super::peer_role_from_capabilities);
             peers.register(
                 peer_name.clone(),
                 peer_addr.clone(),
-                NodeRole::Entry,
+                peer_role,
                 ConnectionSide::Accept,
             );
 

crates/daemon/src/mode/entry.rs

@@ -805,17 +805,7 @@ struct PeerIdentity {
     role: NodeRole,
 }
 
-/// Derive the peer's role from its advertised capabilities.
-///
-/// A peer that both listens and connects is a relay; otherwise it is an exit
-/// node (entry nodes do not connect to other entry nodes in this topology).
-fn role_from_capabilities(caps: wallhack_wire::data::Capabilities) -> NodeRole {
-    if caps.listening && caps.connecting {
-        NodeRole::Relay
-    } else {
-        NodeRole::Exit
-    }
-}
+// Uses super::peer_role_from_capabilities
 
 /// Validate the peer's handshake (PSK proof + identity) for generic `AcceptResult`.
 fn validate_handshake<T: wallhack_core::transport::Transport>(
@@ -842,7 +832,7 @@ fn validate_handshake<T: wallhack_core::transport::Transport>(
     }
 
     let capabilities = hs.capabilities.unwrap_or_default();
-    let role = role_from_capabilities(capabilities);
+    let role = super::peer_role_from_capabilities(capabilities);
 
     if hs.name.is_empty() {
         tracing::debug!("Peer identified with empty name (v{})", hs.version);

crates/daemon/src/mode/exit.rs

@@ -312,17 +312,19 @@ where
             Ok(Some(mut accept_result)) => {
                 let peer_addr = accept_result.peer_addr().to_string();
 
-                // Register the connecting peer using handshake name if available.
-                let peer_name = accept_result
-                    .peer_handshake()
+                // Register the connecting peer using handshake name and capabilities.
+                let peer_hs = accept_result.peer_handshake();
+                let peer_name = peer_hs
                     .filter(|h| !h.name.is_empty())
                     .map_or_else(|| peer_addr.clone(), |h| h.name.clone());
+                let peer_role = peer_hs
+                    .and_then(|h| h.capabilities)
+                    .map_or(NodeRole::Exit, super::peer_role_from_capabilities);
                 tracing::info!("Peer connected: name={peer_name} addr={peer_addr}");
-                // The entry peer connected to us (we accepted), so side=Accept.
                 ctx.peers.register(
                     peer_name.clone(),
                     peer_addr,
-                    NodeRole::Entry,
+                    peer_role,
                     ConnectionSide::Accept,
                 );
 
@@ -442,19 +444,18 @@ async fn run_exit_loop_inner(
         .filter(|h| !h.name.is_empty())
         .map_or_else(|| peer_addr.to_string(), |h| h.name.clone());
 
-    // We connected to the entry peer, so side=Connect.
+    // Derive peer role from capabilities, then register.
+    let peer_capabilities = peer_handshake
+        .as_ref()
+        .and_then(|h| h.capabilities)
+        .unwrap_or_default();
+    let peer_role = super::peer_role_from_capabilities(peer_capabilities);
     ctx.peers.register(
         peer_name.clone(),
         peer_addr.to_string(),
-        NodeRole::Entry,
+        peer_role,
         ConnectionSide::Connect,
     );
-
-    // Apply the peer's advertised capabilities from the handshake.
-    let peer_capabilities = peer_handshake
-        .as_ref()
-        .and_then(|h| h.capabilities)
-        .unwrap_or_default();
     ctx.peers
         .update_capabilities(&peer_name, &peer_capabilities);
 

crates/daemon/src/mode/mod.rs

@@ -63,6 +63,22 @@ pub(crate) struct NodeResources {
     pub node_state: SharedNodeState,
 }
 
+/// Derive a peer's role from its advertised capabilities.
+///
+/// A peer that both listens and connects is a relay; a peer with TUN
+/// capability is an entry; otherwise it is an exit node.
+pub(crate) fn peer_role_from_capabilities(
+    caps: wallhack_wire::data::Capabilities,
+) -> wallhack_core::NodeRole {
+    if caps.listening && caps.connecting {
+        wallhack_core::NodeRole::Relay
+    } else if caps.tun_capable {
+        wallhack_core::NodeRole::Entry
+    } else {
+        wallhack_core::NodeRole::Exit
+    }
+}
+
 /// Inject a Ping message into the control stream.
 pub(crate) async fn send_ping(
     control_tx: &tokio::sync::mpsc::Sender<wallhack_wire::control::ControlMessage>,

crates/daemon/src/mode/relay.rs

@@ -145,6 +145,7 @@ pub async fn run(
                                 e.channels,
                                 e.tasks,
                                 e.control_tx,
+                                e.peer_handshake_rx,
                                 &global,
                                 &listen_spec,
                                 addr,
@@ -197,6 +198,7 @@ pub async fn run(
                                 e.channels,
                                 e.tasks,
                                 e.control_tx,
+                                e.peer_handshake_rx,
                                 &global,
                                 &listen_spec,
                                 addr,
@@ -223,7 +225,7 @@ pub async fn run(
 /// Starts the listener, bridges channels, and returns `Ok(())` when the
 /// source peer disconnects so `connect_loop` reconnects.
 /// Non-generic relay loop: monomorphized once regardless of transport type.
-#[allow(clippy::too_many_arguments)]
+#[allow(clippy::too_many_arguments, clippy::too_many_lines)]
 async fn run_relay_loop_inner(
     peer_addr: String,
     transport: std::sync::Arc<dyn wallhack_core::transport::ErasedTransport>,
@@ -232,6 +234,7 @@ async fn run_relay_loop_inner(
     // Retain control_tx for the full session lifetime — dropping it kills the
     // control stream and causes the source to see the relay as disconnected.
     _source_control_tx: tokio::sync::mpsc::Sender<wallhack_wire::control::ControlMessage>,
+    peer_handshake_rx: Option<tokio::sync::oneshot::Receiver<wallhack_wire::data::Handshake>>,
     global: &GlobalConfig,
     listen_spec: &AddressSpec,
     addr: std::net::SocketAddr,
@@ -244,11 +247,29 @@ async fn run_relay_loop_inner(
 
     let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(());
 
+    // Resolve peer handshake for name and capabilities.
+    let peer_handshake = if let Some(rx) = peer_handshake_rx {
+        match tokio::time::timeout(std::time::Duration::from_secs(10), rx).await {
+            Ok(Ok(hs)) => Some(hs),
+            _ => None,
+        }
+    } else {
+        None
+    };
+    let peer_name = peer_handshake
+        .as_ref()
+        .filter(|h| !h.name.is_empty())
+        .map_or_else(|| peer_addr.clone(), |h| h.name.clone());
+    let peer_role = peer_handshake
+        .as_ref()
+        .and_then(|h| h.capabilities)
+        .map_or(NodeRole::Exit, super::peer_role_from_capabilities);
+
     // Register the source peer so it appears in `wallhack peers`.
     peers.register(
+        peer_name.clone(),
         peer_addr.clone(),
-        peer_addr.clone(),
-        NodeRole::Entry,
+        peer_role,
         ConnectionSide::Connect,
     );
 
@@ -357,7 +378,7 @@ async fn run_relay_loop_inner(
     // Dropping shutdown_tx wakes all bridge tasks holding a shutdown_rx clone.
     drop(shutdown_tx);
 
-    peers.unregister(&peer_addr);
+    peers.unregister(&peer_name);
 
     Ok(())
 }