1 files changed, 31 insertions, 8 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index 329baf1..809bb83 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -136,6 +136,36 @@ window.MeshBayTrace = {
   clear() { try { localStorage.removeItem(TRACE_LOG_KEY); } catch { /* ignore */ } },
 };
 
+// STUN, two providers deep. On the desktop client the hostnames are resolved in
+// the main process (Node's resolver) and handed back as IPs: Chromium's P2P
+// socket manager fails every STUN hostname with ERR_NAME_NOT_RESOLVED in some
+// restricted-resolver environments (a libvirt/KVM guest was where this surfaced)
+// even though every other resolver on the box works. In a browser there is no
+// `meshbay` bridge and the hostnames are used directly — a browser resolves them
+// fine. Resolved once per run; a provider changing IPs is picked up on restart.
+const STUN_URLS = [
+  'stun:stun.l.google.com:19302',
+  'stun:stun1.l.google.com:19302',
+  'stun:stun.cloudflare.com:3478',
+  'stun:stun.services.mozilla.com:3478',
+];
+let _iceServersPromise = null;
+function iceServers() {
+  if (!_iceServersPromise) {
+    _iceServersPromise = (async () => {
+      let urls = STUN_URLS;
+      if (window.meshbay && typeof window.meshbay.resolveStun === 'function') {
+        try {
+          const r = await window.meshbay.resolveStun(STUN_URLS);
+          if (Array.isArray(r) && r.length) urls = r;
+        } catch { /* keep the hostname form */ }
+      }
+      return urls.map((u) => ({ urls: u }));
+    })();
+  }
+  return _iceServersPromise;
+}
+
 function _showTraceView() {
   {
     const renderTraceView = () => {
@@ -355,14 +385,7 @@ class MeshBayTransport {
     this._newNodeBundle = null;
     this._newNodeBundleRecovery = null;
     this._joinError = null;
-    this._pc = new RTCPeerConnection({
-      iceServers: [
-        { urls: 'stun:stun.l.google.com:19302' },
-        { urls: 'stun:stun1.l.google.com:19302' },
-        { urls: 'stun:stun.cloudflare.com:3478' },
-        { urls: 'stun:stun.services.mozilla.com:3478' },
-      ],
-    });
+    this._pc = new RTCPeerConnection({ iceServers: await iceServers() });
 
     this._channel = this._pc.createDataChannel('mnp', { ordered: true });
     this._channel.binaryType = 'arraybuffer';