v1.2.52 - Update nostr_core_lib to v0.4.13 and route nostr logs through relay callback logger

api/index.css

@@ -1486,3 +1486,16 @@ body.dark-mode .admin-verification-content {
     font-size: 12px;
 }
 
+
+/* ================================
+   IP BANS TABLE - compact rows
+   ================================ */
+#ip-bans-table td, #ip-bans-table th {
+    padding: 4px 8px;
+    line-height: 1.3;
+    font-size: 13px;
+}
+#ip-bans-table button {
+    padding: 2px 8px;
+    font-size: 12px;
+}

api/index.html

@@ -16,6 +16,7 @@
             <li><button class="nav-item" data-page="subscriptions">Subscriptions</button></li>
             <li><button class="nav-item" data-page="configuration">Configuration</button></li>
             <li><button class="nav-item" data-page="authorization">Authorization</button></li>
+            <li><button class="nav-item" data-page="ip-bans">IP BANS</button></li>
             <li><button class="nav-item" data-page="relay-events">Relay Events</button></li>
             <li><button class="nav-item" data-page="dm">DM</button></li>
             <li><button class="nav-item" data-page="database">Database Query</button></li>
@@ -111,6 +112,10 @@
                             <td>Process ID</td>
                             <td id="process-id">-</td>
                         </tr>
+                        <tr>
+                            <td>WebSocket Connections</td>
+                            <td id="websocket-connections">-</td>
+                        </tr>
                         <tr>
                             <td>Active Subscriptions</td>
                             <td id="active-subscriptions">-</td>
@@ -119,14 +124,14 @@
                             <td>Memory Usage</td>
                             <td id="memory-usage">-</td>
                         </tr>
-                        <tr>
-                            <td>CPU Core</td>
-                            <td id="cpu-core">-</td>
-                        </tr>
                         <tr>
                             <td>CPU Usage</td>
                             <td id="cpu-usage">-</td>
                         </tr>
+                        <tr>
+                            <td>CPU Core</td>
+                            <td id="cpu-core">-</td>
+                        </tr>
                         <tr>
                             <td>Oldest Event</td>
                             <td id="oldest-event">-</td>
@@ -382,6 +387,109 @@ WEB OF TRUST
         </div>
     </div>
 
+    <!-- IP BANS Section -->
+    <div class="section" id="ipBansSection" style="display: none;">
+        <div class="section-header">
+            IP BAN MANAGEMENT
+        </div>
+
+        <!-- Statistics Cards -->
+        <div class="input-group">
+            <div class="config-table-container">
+                <table class="config-table" id="ip-bans-stats-table">
+                    <thead>
+                        <tr>
+                            <th>Total IPs Tracked</th>
+                            <th>Currently Banned</th>
+                            <th>Total Bans Issued</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <tr>
+                            <td id="ip-bans-total">-</td>
+                            <td id="ip-bans-active">-</td>
+                            <td id="ip-bans-issued">-</td>
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+        </div>
+
+        <!-- Add Ban Form -->
+        <div class="input-group">
+            <h3>Manually Ban IP Address</h3>
+            <div class="form-group">
+                <label for="ban-ip-input">IP Address:</label>
+                <input type="text" id="ban-ip-input" placeholder="192.168.1.100">
+            </div>
+            <div class="form-group">
+                <label for="ban-duration-select">Ban Duration:</label>
+                <select id="ban-duration-select">
+                    <option value="3600">1 Hour</option>
+                    <option value="86400" selected>24 Hours</option>
+                    <option value="604800">7 Days</option>
+                    <option value="2592000">30 Days</option>
+                    <option value="31536000">1 Year</option>
+                    <option value="999999999">Permanent</option>
+                </select>
+            </div>
+            <div class="inline-buttons">
+                <button type="button" id="add-ban-btn">BAN IP</button>
+            </div>
+            <div id="add-ban-status" class="status-message"></div>
+        </div>
+
+        <!-- Whitelist Management -->
+        <div class="input-group">
+            <h3>IP Whitelist (Never Banned)</h3>
+            <p style="font-size:13px;opacity:0.8;">IPs in this list are never idle-banned. Comma-separated.</p>
+            <div class="form-group">
+                <label for="whitelist-ip-input">Add IP to Whitelist:</label>
+                <input type="text" id="whitelist-ip-input" placeholder="103.81.231.220">
+            </div>
+            <div class="inline-buttons">
+                <button type="button" id="add-whitelist-btn">ADD TO WHITELIST</button>
+            </div>
+            <div id="whitelist-status" class="status-message"></div>
+            <div id="whitelist-current" style="margin-top:8px;font-size:13px;"></div>
+        </div>
+
+        <!-- Filter Controls -->
+        <div class="input-group">
+            <div class="inline-buttons">
+                <button type="button" id="ip-ban-filter-all" class="active">All IPs</button>
+                <button type="button" id="ip-ban-filter-banned">Currently Banned</button>
+                <button type="button" id="ip-ban-filter-expired">Expired</button>
+                <button type="button" id="refresh-ip-bans-btn">REFRESH</button>
+            </div>
+        </div>
+
+        <!-- IP Bans List -->
+        <div class="input-group">
+            <label>Banned IP Addresses:</label>
+            <div class="config-table-container">
+                <table class="config-table" id="ip-bans-table">
+                        <thead>
+                            <tr>
+                                <th>IP Address</th>
+                                <th>Status</th>
+                                <th>Banned Until</th>
+                                <th>Failures</th>
+                                <th>Authed Successfully</th>
+                                <th>Connection Attempts</th>
+                                <th>Actions</th>
+                            </tr>
+                        </thead>
+                    <tbody id="ip-bans-tbody">
+                        <tr>
+                                                    <td colspan="7" style="text-align: center;">Click REFRESH to load IP bans</td>
+                                                </tr>
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+
     <!-- RELAY EVENTS Section -->
     <div class="section" id="relayEventsSection" style="display: none;">
         <div class="section-header">
@@ -467,6 +575,10 @@ WEB OF TRUST
                     <option value="event_kinds">Event Kinds Distribution</option>
                     <option value="time_stats">Time-based Statistics</option>
                 </optgroup>
+                <optgroup label="IP Ban Queries">
+                    <option value="banned_ips_summary">Banned IPs Summary</option>
+                    <option value="banned_ips_list">All Banned IP Addresses</option>
+                </optgroup>
                 <optgroup label="Query History" id="history-group">
                     <!-- Dynamically populated from localStorage -->
                 </optgroup>

api/nostr.bundle.js

@@ -3297,8 +3297,18 @@ var NostrTools = (() => {
       this.enablePing = opts.enablePing;
     }
     async ensureRelay(url, params) {
+      const rawUrl = url;
+      const debugEnabled = typeof window !== "undefined" && !!window.__SIMPLE_POOL_DEBUG__;
       url = normalizeURL(url);
       let relay = this.relays.get(url);
+      if (debugEnabled) {
+        console.log("🔎 SIMPLE_POOL ensureRelay START", {
+          rawUrl,
+          normalizedUrl: url,
+          hadRelay: !!relay,
+          relayMapKeysBefore: Array.from(this.relays.keys())
+        });
+      }
       if (!relay) {
         relay = new AbstractRelay(url, {
           verifyEvent: this.trustedRelayURLs.has(url) ? alwaysTrue : this.verifyEvent,
@@ -3306,13 +3316,38 @@ var NostrTools = (() => {
           enablePing: this.enablePing
         });
         relay.onclose = () => {
+          if (debugEnabled) {
+            console.log("🔎 SIMPLE_POOL ensureRelay onclose", {
+              normalizedUrl: url,
+              relayMapKeysBeforeDelete: Array.from(this.relays.keys())
+            });
+          }
           this.relays.delete(url);
+          if (debugEnabled) {
+            console.log("🔎 SIMPLE_POOL ensureRelay onclose complete", {
+              normalizedUrl: url,
+              relayMapKeysAfterDelete: Array.from(this.relays.keys())
+            });
+          }
         };
         if (params?.connectionTimeout)
           relay.connectionTimeout = params.connectionTimeout;
         this.relays.set(url, relay);
+        if (debugEnabled) {
+          console.log("🔎 SIMPLE_POOL ensureRelay created relay", {
+            normalizedUrl: url,
+            relayMapKeysAfterCreate: Array.from(this.relays.keys())
+          });
+        }
       }
       await relay.connect();
+      if (debugEnabled) {
+        console.log("🔎 SIMPLE_POOL ensureRelay connected", {
+          normalizedUrl: url,
+          relayConnected: relay.connected,
+          relayMapKeysAfterConnect: Array.from(this.relays.keys())
+        });
+      }
       return relay;
     }
     close(relays) {
@@ -3334,16 +3369,26 @@ var NostrTools = (() => {
     }
     subscribeMany(relays, filters, params) {
       params.onauth = params.onauth || params.doauth;
+      const debugEnabled = typeof window !== "undefined" && !!window.__SIMPLE_POOL_DEBUG__;
       const request = [];
       const uniqUrls = [];
       for (let i2 = 0; i2 < relays.length; i2++) {
         const url = normalizeURL(relays[i2]);
         if (uniqUrls.indexOf(url) === -1) {
+          uniqUrls.push(url);
           for (let f2 = 0; f2 < filters.length; f2++) {
             request.push({ url, filter: filters[f2] });
           }
         }
       }
+      if (debugEnabled) {
+        console.log("🔎 SIMPLE_POOL subscribeMany", {
+          relaysInput: relays,
+          uniqUrls,
+          filtersCount: filters.length,
+          requestsCount: request.length
+        });
+      }
       return this.subscribeMap(request, params);
     }
     subscribeMap(requests, params) {
@@ -3391,14 +3436,31 @@ var NostrTools = (() => {
         _knownIds.add(id);
         return have;
       };
+      const debugEnabled = typeof window !== "undefined" && !!window.__SIMPLE_POOL_DEBUG__;
       const allOpened = Promise.all(
         requests.map(async ({ url, filter }, i2) => {
+          if (debugEnabled) {
+            console.log("🔎 SIMPLE_POOL subscribeMap request", {
+              index: i2,
+              url,
+              filterKinds: filter?.kinds,
+              hasAuthorFilter: !!filter?.authors,
+              hasPTagFilter: !!filter?.["#p"]
+            });
+          }
           let relay;
           try {
             relay = await this.ensureRelay(url, {
               connectionTimeout: params.maxWait ? Math.max(params.maxWait * 0.8, params.maxWait - 1e3) : void 0
             });
           } catch (err) {
+            if (debugEnabled) {
+              console.log("🔎 SIMPLE_POOL subscribeMap ensureRelay FAILED", {
+                index: i2,
+                url,
+                error: err?.message || String(err)
+              });
+            }
             handleClose(i2, err?.message || String(err));
             return;
           }
@@ -3480,18 +3542,50 @@ var NostrTools = (() => {
       return events[0] || null;
     }
     publish(relays, event, options) {
-      return relays.map(normalizeURL).map(async (url, i2, arr) => {
+      const debugEnabled = typeof window !== "undefined" && !!window.__SIMPLE_POOL_DEBUG__;
+      const normalizedRelays = relays.map(normalizeURL);
+      if (debugEnabled) {
+        console.log("🔎 SIMPLE_POOL publish START", {
+          relaysInput: relays,
+          normalizedRelays,
+          eventKind: event?.kind,
+          eventId: event?.id
+        });
+      }
+      return normalizedRelays.map(async (url, i2, arr) => {
         if (arr.indexOf(url) !== i2) {
+          if (debugEnabled) {
+            console.log("🔎 SIMPLE_POOL publish duplicate URL", { url, index: i2 });
+          }
           return Promise.reject("duplicate url");
         }
         let r = await this.ensureRelay(url);
+        if (debugEnabled) {
+          console.log("🔎 SIMPLE_POOL publish ensured relay", {
+            url,
+            relayConnected: r?.connected,
+            relayMapKeys: Array.from(this.relays.keys())
+          });
+        }
         return r.publish(event).catch(async (err) => {
+          if (debugEnabled) {
+            console.log("🔎 SIMPLE_POOL publish ERROR", {
+              url,
+              error: err?.message || String(err)
+            });
+          }
           if (err instanceof Error && err.message.startsWith("auth-required: ") && options?.onauth) {
             await r.auth(options.onauth);
             return r.publish(event);
           }
           throw err;
         }).then((reason) => {
+          if (debugEnabled) {
+            console.log("🔎 SIMPLE_POOL publish SUCCESS", {
+              url,
+              reason
+            });
+          }
           if (this.trackRelays) {
             let set = this.seenOn.get(event.id);
             if (!set) {

config.csv

@@ -0,0 +1 @@
+key,value,data_type,description,category,requires_restart,created_at,updated_at

plans/idle_connection_ban_plan.md

@@ -0,0 +1,585 @@
+# Plan: Ban Idle and Early-Disconnect Connections
+
+## Problem Statement
+
+The relay needs to defend against spam connections that:
+1. Connect via WebSocket and sit idle doing nothing (the original problem)
+2. Connect and immediately disconnect without subscribing or posting (the new requirement)
+
+Both patterns indicate bot/scanner behavior that should result in IP bans.
+
+## Goal
+
+Implement a system that:
+- Bans IPs that connect but never send a REQ or EVENT (regardless of how the connection ends)
+- Works **independent of NIP-42 authentication** (no auth required)
+- Allows legitimate users to connect and use the relay normally
+- Uses existing IP ban infrastructure
+
+## Architecture Overview
+
+```mermaid
+flowchart TD
+    A[Client connects] --> B{IP banned?}
+    B -->|Yes| C[Reject immediately]
+    B -->|No| D[Set idle timeout timer]
+    D --> E{Client sends REQ or EVENT?}
+    E -->|Yes| F[Mark session ACTIVE<br>Cancel idle timer]
+    E -->|No| G{Connection closes?}
+    G --> H{Session was ACTIVE?}
+    H -->|Yes| I[Clean close - no ban]
+    H -->|No| J["ip_ban_record_failure()<br>→ may trigger ban"]
+    F --> K[Normal operation]
+    K --> L[Connection closes]
+    L --> I
+```
+
+## Key Insight
+
+The distinction between "idle timeout" and "early disconnect" is minimal:
+- **Idle timeout**: Connection closed by server because client never became ACTIVE
+- **Early disconnect**: Connection closed by client because client never became ACTIVE
+
+Both result in the same check: `if (!session_was_active) ban_ip()`
+
+## Implementation Plan
+
+### 1. Add Session Activity Tracking
+
+**File: `src/websockets.h`**
+
+Add to `struct per_session_data`:
+
+```c
+// Session activity tracking for idle connection banning
+int session_active;           // 1 if client sent REQ or EVENT, 0 otherwise
+int idle_timeout_sec;         // Timeout value for this session (copied from config)
+```
+
+### 2. Set Idle Timeout on All Connections
+
+**File: `src/websockets.c` - `LWS_CALLBACK_ESTABLISHED`**
+
+Currently (lines 561-572):
+```c
+// Only set timeout if auth is required
+if (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) {
+    int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+    if (auth_timeout > 0) {
+        lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, auth_timeout);
+    }
+}
+```
+
+Change to:
+```c
+// Initialize session activity tracking
+pss->session_active = 0;
+pss->idle_timeout_sec = get_config_int("idle_connection_timeout_sec", 30);
+
+// Set idle timeout for ALL connections (not just auth-required)
+// This catches bots that connect and do nothing
+if (pss->idle_timeout_sec > 0) {
+    lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, pss->idle_timeout_sec);
+    DEBUG_TRACE("Idle timeout set: %d seconds for connection from %s",
+                pss->idle_timeout_sec, pss->client_ip);
+}
+
+// Also set auth timeout if auth is required (separate concern)
+if (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) {
+    int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+    // Use the shorter of the two timeouts
+    int effective_timeout = (pss->idle_timeout_sec > 0 && pss->idle_timeout_sec < auth_timeout) 
+                            ? pss->idle_timeout_sec 
+                            : auth_timeout;
+    if (effective_timeout > 0) {
+        lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, effective_timeout);
+    }
+}
+```
+
+### 3. Mark Session as Active on Valid Activity
+
+**File: `src/websockets.c` - `LWS_CALLBACK_RECEIVE`**
+
+When processing REQ message (around line 1030):
+```c
+// Before handling REQ, mark session as active
+pthread_mutex_lock(&pss->session_lock);
+pss->session_active = 1;
+pthread_mutex_unlock(&pss->session_lock);
+
+// Cancel idle timeout - this is legitimate usage
+lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+```
+
+When processing EVENT message (around line 1380):
+```c
+// Before handling EVENT, mark session as active
+pthread_mutex_lock(&pss->session_lock);
+pss->session_active = 1;
+pthread_mutex_unlock(&pss->session_lock);
+
+// Cancel idle timeout - this is legitimate usage
+lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+```
+
+**Note**: We should also consider AUTH as "activity" since the client is engaging with the protocol:
+```c
+// In handle_nip42_auth_signed_event (nip042.c)
+// After successful auth, also mark session active
+pthread_mutex_lock(&pss->session_lock);
+pss->session_active = 1;
+pthread_mutex_unlock(&pss->session_lock);
+```
+
+### 3.5. Separate Rate Limiting for Idle Connections
+
+Per user feedback, idle/early-disconnect failures have **separate rate limiting** from auth failures. This requires:
+
+**New Config Keys:**
+
+| Config Key | Type | Default | Range | Description |
+|------------|------|---------|-------|-------------|
+| `idle_ban_threshold` | int | 3 | 1-100 | Idle failures before ban |
+| `idle_ban_window_sec` | int | 60 | 10-3600 | Window for counting idle failures |
+| `idle_ban_duration_sec` | int | 300 | 60-86400 | Initial idle ban duration |
+
+**Add to `ip_ban_entry_t` in `src/ip_ban.c`:**
+
+```c
+typedef struct {
+    int state;
+    char ip[46];
+    
+    // Auth failure tracking (existing)
+    int failure_count;
+    time_t first_failure;
+    time_t banned_until;
+    int ban_count;
+    
+    // NEW: Idle failure tracking (separate)
+    int idle_failure_count;
+    time_t idle_first_failure;
+    time_t idle_banned_until;
+    int idle_ban_count;
+    
+    // Other existing fields...
+    int has_authed_successfully;
+    time_t last_success_at;
+    int total_connections;
+    int total_failures;
+    int total_successes;
+    time_t first_seen;
+} ip_ban_entry_t;
+```
+
+**New function in `src/ip_ban.c`:**
+
+```c
+// Record an idle/early-disconnect failure for an IP
+void ip_ban_record_idle_failure(const char* ip) {
+    if (!ip || !g_initialized) return;
+    if (!get_config_bool("idle_ban_enabled", 1)) return;
+
+    int threshold = get_config_int("idle_ban_threshold", 3);
+    int window_sec = get_config_int("idle_ban_window_sec", 60);
+    int ban_duration = get_config_int("idle_ban_duration_sec", 300);
+
+    pthread_mutex_lock(&g_ban_mutex);
+    ip_ban_entry_t* entry = get_or_create_entry(ip);
+    if (!entry) {
+        pthread_mutex_unlock(&g_ban_mutex);
+        return;
+    }
+
+    time_t now = time(NULL);
+
+    // Reset window if expired
+    if (entry->idle_first_failure > 0 && (now - entry->idle_first_failure) > window_sec) {
+        entry->idle_failure_count = 0;
+        entry->idle_first_failure = now;
+    }
+    if (entry->idle_first_failure == 0) {
+        entry->idle_first_failure = now;
+    }
+
+    entry->idle_failure_count++;
+    entry->total_failures++;
+
+    DEBUG_TRACE("IP %s idle failure count: %d/%d", ip, entry->idle_failure_count, threshold);
+
+    if (entry->idle_failure_count >= threshold) {
+        int duration = ban_duration;
+        for (int i = 0; i < entry->idle_ban_count && duration < 86400; i++) {
+            duration *= 2;
+        }
+        if (duration > 86400) duration = 86400;
+
+        entry->idle_banned_until = now + duration;
+        entry->idle_ban_count++;
+        entry->idle_failure_count = 0;
+        entry->idle_first_failure = 0;
+
+        DEBUG_WARN("IP %s banned for %d seconds (idle ban #%d) after %d idle failures",
+                   ip, duration, entry->idle_ban_count, threshold);
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+}
+```
+
+**Update `ip_ban_is_banned()` to check BOTH ban types:**
+
+```c
+int ip_ban_is_banned(const char* ip) {
+    if (!ip || !g_initialized) return 0;
+    
+    pthread_mutex_lock(&g_ban_mutex);
+    int idx = find_slot(ip);
+    if (idx < 0 || g_ban_table[idx].state == IP_BAN_EMPTY) {
+        pthread_mutex_unlock(&g_ban_mutex);
+        return 0;
+    }
+
+    ip_ban_entry_t* entry = &g_ban_table[idx];
+    time_t now = time(NULL);
+    int banned = 0;
+
+    // Check auth ban (if enabled)
+    if (get_config_bool("auth_fail_ban_enabled", 1) &&
+        entry->banned_until > 0 && now < entry->banned_until) {
+        banned = 1;
+    }
+    
+    // Check idle ban (if enabled)
+    if (get_config_bool("idle_ban_enabled", 1) &&
+        entry->idle_banned_until > 0 && now < entry->idle_banned_until) {
+        banned = 1;
+    }
+    
+    // Clear expired bans
+    if (!banned) {
+        if (entry->banned_until > 0 && now >= entry->banned_until) {
+            entry->banned_until = 0;
+            entry->failure_count = 0;
+            entry->first_failure = 0;
+        }
+        if (entry->idle_banned_until > 0 && now >= entry->idle_banned_until) {
+            entry->idle_banned_until = 0;
+            entry->idle_failure_count = 0;
+            entry->idle_first_failure = 0;
+        }
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+    return banned;
+}
+```
+
+**Update persistence:**
+- `ip_ban_load_from_db()`: Load idle_* fields from new columns
+- `ip_ban_save_to_db()`: Save idle_* fields to new columns
+- Add migration SQL to create new columns if they don't exist
+
+**Add to `src/ip_ban.h`:**
+
+```c
+// Record an idle/early-disconnect failure for an IP
+void ip_ban_record_idle_failure(const char* ip);
+```
+
+### 4. Record Failure on Inactive Connection Close
+
+**File: `src/websockets.c` - `LWS_CALLBACK_CLOSED`**
+
+Currently (lines 2121-2128):
+```c
+// Record auth failure if connection closed while unauthenticated and auth was required
+if (!pss->authenticated &&
+    (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) &&
+    pss->auth_challenge_sent &&
+    strlen(pss->client_ip) > 0) {
+    ip_ban_record_failure(pss->client_ip);
+}
+```
+
+Change to:
+```c
+// Record failure if connection closed without ever becoming active
+// This catches:
+// 1. Idle connections that timed out (never sent REQ/EVENT/AUTH)
+// 2. Early disconnects (client closed before sending REQ/EVENT/AUTH)
+if (!pss->session_active && strlen(pss->client_ip) > 0) {
+    // Use separate idle failure recording (has its own threshold/duration)
+    ip_ban_record_idle_failure(pss->client_ip);
+    DEBUG_LOG("Recording idle/early-disconnect failure for IP %s (connected %ld seconds)",
+              pss->client_ip,
+              time(NULL) - pss->connection_established);
+}
+// Legacy: record auth failure if auth was required but not completed
+else if (!pss->authenticated &&
+         (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) &&
+         pss->auth_challenge_sent &&
+         strlen(pss->client_ip) > 0) {
+    ip_ban_record_failure(pss->client_ip);
+}
+```
+
+### 5. Add Configuration Keys
+
+**File: `src/config.c` - Add validation for new keys**
+
+In the config validation section, add:
+
+```c
+// Idle connection ban settings
+if (strcmp(key, "idle_connection_timeout_sec") == 0) {
+    if (!is_valid_positive_integer(value)) {
+        snprintf(error_msg, error_size, "invalid idle_connection_timeout_sec '%s' (must be positive integer)", value);
+        return -1;
+    }
+    int timeout = atoi(value);
+    if (timeout < 5 || timeout > 300) {
+        snprintf(error_msg, error_size, "idle_connection_timeout_sec must be between 5 and 300 seconds");
+        return -1;
+    }
+    return 0;
+}
+
+if (strcmp(key, "idle_ban_enabled") == 0) {
+    if (!is_valid_boolean(value)) {
+        snprintf(error_msg, error_size, "invalid boolean value '%s' for idle_ban_enabled", value);
+        return -1;
+    }
+    return 0;
+}
+
+if (strcmp(key, "idle_ban_threshold") == 0) {
+    if (!is_valid_positive_integer(value)) {
+        snprintf(error_msg, error_size, "invalid idle_ban_threshold '%s' (must be positive integer)", value);
+        return -1;
+    }
+    int threshold = atoi(value);
+    if (threshold < 1 || threshold > 100) {
+        snprintf(error_msg, error_size, "idle_ban_threshold must be between 1 and 100");
+        return -1;
+    }
+    return 0;
+}
+
+if (strcmp(key, "idle_ban_window_sec") == 0) {
+    if (!is_valid_positive_integer(value)) {
+        snprintf(error_msg, error_size, "invalid idle_ban_window_sec '%s' (must be positive integer)", value);
+        return -1;
+    }
+    int window = atoi(value);
+    if (window < 10 || window > 3600) {
+        snprintf(error_msg, error_size, "idle_ban_window_sec must be between 10 and 3600");
+        return -1;
+    }
+    return 0;
+}
+
+if (strcmp(key, "idle_ban_duration_sec") == 0) {
+    if (!is_valid_positive_integer(value)) {
+        snprintf(error_msg, error_size, "invalid idle_ban_duration_sec '%s' (must be positive integer)", value);
+        return -1;
+    }
+    int duration = atoi(value);
+    if (duration < 60 || duration > 86400) {
+        snprintf(error_msg, error_size, "idle_ban_duration_sec must be between 60 and 86400");
+        return -1;
+    }
+    return 0;
+}
+```
+
+Also update the config introspection/documentation functions to describe these keys.
+
+### 6. Add API Documentation
+
+**File: `src/api.c` - Add to config metadata**
+
+```c
+{"idle_connection_timeout_sec", "int", 5, 300},
+{"idle_ban_enabled", "bool", 0, 1},
+{"idle_ban_threshold", "int", 1, 100},
+{"idle_ban_window_sec", "int", 10, 3600},
+{"idle_ban_duration_sec", "int", 60, 86400},
+```
+
+Add descriptions in the config query handler:
+```c
+} else if (strcmp(key, "idle_connection_timeout_sec") == 0) {
+    description = "Seconds before an idle connection (no REQ/EVENT) is closed and IP flagged. 0 to disable.";
+} else if (strcmp(key, "idle_ban_enabled") == 0) {
+    description = "Whether to ban IPs that repeatedly connect without sending REQ or EVENT.";
+} else if (strcmp(key, "idle_ban_threshold") == 0) {
+    description = "Number of idle/early-disconnect failures before banning an IP.";
+} else if (strcmp(key, "idle_ban_window_sec") == 0) {
+    description = "Time window in seconds for counting idle failures.";
+} else if (strcmp(key, "idle_ban_duration_sec") == 0) {
+    description = "Initial ban duration in seconds for idle failures (doubles each time).";
+}
+```
+
+### 7. Update ip_ban Persistence and Cleanup
+
+**File: `src/ip_ban.c` - Update `ip_ban_load_from_db()`**
+
+Add migration SQL to create new columns if they don't exist, then load them:
+```sql
+ALTER TABLE ip_bans ADD COLUMN idle_failure_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE ip_bans ADD COLUMN idle_ban_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE ip_bans ADD COLUMN idle_banned_until INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE ip_bans ADD COLUMN idle_first_failure INTEGER NOT NULL DEFAULT 0;
+```
+
+**File: `src/ip_ban.c` - Update `ip_ban_save_to_db()`**
+
+Add the idle_* fields to the INSERT/REPLACE statement.
+
+**File: `src/ip_ban.c` - Update `ip_ban_cleanup()`**
+
+Add cleanup logic for idle ban entries (same pattern as auth ban cleanup).
+
+**File: `src/ip_ban.c` - Update `ip_ban_log_stats()`**
+
+Add idle ban count to the periodic log summary:
+```c
+DEBUG_WARN("IP BAN SUMMARY: %d auth-banned, %d idle-banned, %d tracked, %d trusted",
+           auth_banned_count, idle_banned_count, tracked_count, trusted_count);
+```
+
+## Configuration Reference
+
+### Idle Connection Settings
+
+| Config Key | Type | Default | Range | Description |
+|------------|------|---------|-------|-------------|
+| `idle_connection_timeout_sec` | int | 30 | 5-300 | Seconds to wait for REQ/EVENT before closing connection. 0 = disable idle timeout. |
+| `idle_ban_enabled` | bool | true | true/false | Whether to ban IPs with repeated idle/early-disconnect failures. |
+| `idle_ban_threshold` | int | 3 | 1-100 | Idle failures before ban. |
+| `idle_ban_window_sec` | int | 60 | 10-3600 | Window for counting idle failures. |
+| `idle_ban_duration_sec` | int | 300 | 60-86400 | Initial idle ban duration. |
+
+### Auth Failure Settings (Existing)
+
+| Config Key | Type | Default | Range | Description |
+|------------|------|---------|-------|-------------|
+| `auth_fail_ban_enabled` | bool | true | true/false | Whether to ban IPs with failed auth. |
+| `auth_fail_ban_threshold` | int | 3 | 1-100 | Auth failures before ban. |
+| `auth_fail_window_sec` | int | 60 | 10-3600 | Window for counting auth failures. |
+| `auth_fail_ban_duration_sec` | int | 300 | 60-86400 | Initial auth ban duration. |
+
+## Behavior Matrix
+
+| Scenario | idle_timeout_sec | idle_ban_enabled | Result |
+|----------|------------------|------------------|--------|
+| Connect → do nothing → timeout | >0 | true | Connection closed, IP failure recorded, may be banned |
+| Connect → do nothing → timeout | >0 | false | Connection closed, no ban |
+| Connect → immediate disconnect | any | true | IP failure recorded, may be banned |
+| Connect → immediate disconnect | any | false | No ban |
+| Connect → send REQ | any | any | Session active, no ban |
+| Connect → send EVENT | any | any | Session active, no ban |
+| Connect → send AUTH (NIP-42) | any | any | Session active, no ban |
+
+## Testing Strategy
+
+1. **Idle timeout test**: Connect via wscat, wait 30 seconds, verify disconnect and ban table entry
+2. **Early disconnect test**: Connect via wscat, immediately Ctrl-C, verify ban table entry
+3. **Active session test**: Connect, send REQ, disconnect immediately, verify NO ban
+4. **Config disable test**: Set `idle_ban_enabled=false`, repeat test 1, verify no ban
+5. **Timeout config test**: Set `idle_connection_timeout_sec=5`, verify faster disconnect
+
+## Files to Modify
+
+| File | Change Type |
+|------|-------------|
+| `src/websockets.h` | Add `session_active` and `idle_timeout_sec` fields to `per_session_data` |
+| `src/websockets.c` ~565 | Set idle timeout on ALL connections in `LWS_CALLBACK_ESTABLISHED` |
+| `src/websockets.c` ~1030 | Mark `session_active=1` and cancel idle timer on REQ |
+| `src/websockets.c` ~1380 | Mark `session_active=1` and cancel idle timer on EVENT |
+| `src/websockets.c` ~2121 | Call `ip_ban_record_idle_failure()` for inactive sessions in `LWS_CALLBACK_CLOSED` |
+| `src/nip042.c` ~130 | Mark `session_active=1` on successful AUTH |
+| `src/ip_ban.h` | Add `ip_ban_record_idle_failure()` declaration |
+| `src/ip_ban.c` | Add idle_* fields to `ip_ban_entry_t`, new `ip_ban_record_idle_failure()` function, update `ip_ban_is_banned()` to check both ban types, update persistence and cleanup |
+| `src/config.c` ~987+ | Add validation for 5 new idle_* config keys |
+| `src/api.c` ~664 | Add config metadata entries for idle_* keys |
+
+## Deployment on Existing Server
+
+### Config Keys: No Manual SQL Required
+
+All config keys use [`get_config_int()`](src/config.c:300) and [`get_config_bool()`](src/config.c:313) which return **hardcoded defaults** when a key doesn't exist in the config table. The new code will work immediately with these defaults:
+
+- `idle_connection_timeout_sec` → defaults to 30
+- `idle_ban_enabled` → defaults to true
+- `idle_ban_threshold` → defaults to 3
+- `idle_ban_window_sec` → defaults to 60
+- `idle_ban_duration_sec` → defaults to 300
+
+If you want to **override** any defaults, you can insert them into the config table. From the same directory as the `.db` file:
+
+```bash
+# Find your database file
+DB_FILE=$(ls *.db | head -1)
+
+# Optional: Insert custom values (only if you want non-default settings)
+sqlite3 "$DB_FILE" "INSERT OR REPLACE INTO config (key, value) VALUES ('idle_connection_timeout_sec', '30');"
+sqlite3 "$DB_FILE" "INSERT OR REPLACE INTO config (key, value) VALUES ('idle_ban_enabled', 'true');"
+sqlite3 "$DB_FILE" "INSERT OR REPLACE INTO config (key, value) VALUES ('idle_ban_threshold', '3');"
+sqlite3 "$DB_FILE" "INSERT OR REPLACE INTO config (key, value) VALUES ('idle_ban_window_sec', '60');"
+sqlite3 "$DB_FILE" "INSERT OR REPLACE INTO config (key, value) VALUES ('idle_ban_duration_sec', '300');"
+```
+
+Or change them via the admin API/web UI after deployment.
+
+### ip_bans Table: Automatic Migration
+
+The `ip_bans` table needs 4 new columns for idle tracking. The updated [`ip_ban_load_from_db()`](src/ip_ban.c:93) will run `ALTER TABLE` statements automatically on startup. These are safe because SQLite's `ALTER TABLE ADD COLUMN` is a no-op if the column already exists (we'll use error-tolerant execution).
+
+If you prefer to run the migration manually before deploying:
+
+```bash
+DB_FILE=$(ls *.db | head -1)
+
+sqlite3 "$DB_FILE" <<'SQL'
+ALTER TABLE ip_bans ADD COLUMN idle_failure_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE ip_bans ADD COLUMN idle_ban_count INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE ip_bans ADD COLUMN idle_banned_until INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE ip_bans ADD COLUMN idle_first_failure INTEGER NOT NULL DEFAULT 0;
+SQL
+```
+
+**Note:** SQLite will error on `ALTER TABLE ADD COLUMN` if the column already exists, but the code will handle this gracefully (ignore the error). Running it manually is optional — the relay will do it on startup.
+
+### Deployment Steps
+
+1. Build and deploy with `deploy_lt.sh` as usual
+2. The relay starts, `ip_ban_load_from_db()` auto-migrates the `ip_bans` table
+3. Config keys use defaults immediately — no manual SQL needed
+4. Optionally tune settings via admin API or direct SQL
+
+## Backward Compatibility
+
+- Default `idle_connection_timeout_sec=30` provides immediate protection
+- Default `idle_ban_enabled=true` maintains current spam protection behavior
+- Setting `idle_connection_timeout_sec=0` restores old behavior (no idle timeout)
+- Setting `idle_ban_enabled=false` allows connections without banning (for debugging)
+- Existing auth-based banning continues to work independently with its own thresholds
+- Database migration adds new columns with defaults — existing ban data preserved
+
+## Summary
+
+This plan implements a unified "session activity" tracking system with **separate rate limiting** for idle vs auth failures:
+
+1. **Catches idle connections** via `lws_set_timeout()` on ALL connections (not just auth-required)
+2. **Catches early disconnects** via the same `!session_active` check on close
+3. **Respects legitimate users** who actually use the relay (REQ/EVENT/AUTH marks session active)
+4. **Separate idle ban tracking** — idle failures have their own threshold, window, and duration independent of auth failures
+5. **Extends existing ban infrastructure** — adds idle_* fields to `ip_ban_entry_t`, unified `ip_ban_is_banned()` checks both ban types
+6. **Fully configurable** — 5 new config keys for idle banning, all tunable via admin events
+
+The key insight is that there's no meaningful difference between "idle timeout" and "early disconnect" — both indicate a client that connected but never actually used the relay. The same `!session_active` check handles both cases, and the separate rate limiting ensures idle bots don't interfere with auth failure tracking for legitimate clients who fail NIP-42.

relay.pid

@@ -1 +1 @@
-2039374
+3134018

src/api.c

@@ -13,6 +13,7 @@ extern void log_query_execution(const char* query_type, const char* sub_id,
 #include <pthread.h>
 #include <libwebsockets.h>
 #include <cjson/cJSON.h>
+int get_active_connection_count(void);
 #include <sqlite3.h>
 #include <time.h>
 #include <sys/stat.h>
@@ -671,6 +672,13 @@ static const config_definition_t known_configs[] = {
     {"nip42_time_tolerance", "int", 60, 3600},
     {"nip70_protected_events_enabled", "bool", 0, 1},
 
+    // Idle Connection Ban Settings
+    {"idle_connection_timeout_sec", "int", 0, 300},
+    {"idle_ban_enabled", "bool", 0, 1},
+    {"idle_ban_threshold", "int", 1, 100},
+    {"idle_ban_window_sec", "int", 10, 3600},
+    {"idle_ban_duration_sec", "int", 60, 86400},
+
     // Server Core Settings
     {"relay_port", "int", 1, 65535},
     {"max_connections", "int", 1, 10000},
@@ -1284,13 +1292,16 @@ cJSON* query_cpu_metrics(void) {
     pid_t pid = getpid();
     cJSON_AddNumberToObject(cpu_stats, "process_id", (double)pid);
 
-    // Get memory usage from /proc/self/status
+    // Get active WebSocket connection count
+    cJSON_AddNumberToObject(cpu_stats, "active_connections", (double)get_active_connection_count());
+
+    // Get memory usage from /proc/self/status and calculate MEM%
+    unsigned long rss_kb = 0;
     FILE* mem_stat = fopen("/proc/self/status", "r");
     if (mem_stat) {
         char line[256];
         while (fgets(line, sizeof(line), mem_stat)) {
             if (strncmp(line, "VmRSS:", 6) == 0) {
-                unsigned long rss_kb;
                 if (sscanf(line, "VmRSS: %lu kB", &rss_kb) == 1) {
                     double rss_mb = rss_kb / 1024.0;
                     cJSON_AddNumberToObject(cpu_stats, "memory_usage_mb", rss_mb);
@@ -1301,6 +1312,25 @@ cJSON* query_cpu_metrics(void) {
         fclose(mem_stat);
     }
 
+    // Get total system memory from /proc/meminfo for MEM%
+    if (rss_kb > 0) {
+        FILE* meminfo = fopen("/proc/meminfo", "r");
+        if (meminfo) {
+            char line[256];
+            while (fgets(line, sizeof(line), meminfo)) {
+                if (strncmp(line, "MemTotal:", 9) == 0) {
+                    unsigned long total_kb;
+                    if (sscanf(line, "MemTotal: %lu kB", &total_kb) == 1 && total_kb > 0) {
+                        double mem_pct = (rss_kb * 100.0) / total_kb;
+                        cJSON_AddNumberToObject(cpu_stats, "memory_percent", mem_pct);
+                    }
+                    break;
+                }
+            }
+            fclose(meminfo);
+        }
+    }
+
     return cpu_stats;
 }
 
@@ -2222,6 +2252,16 @@ char* generate_config_change_confirmation(const char* key, const char* old_value
         description = "This sets the maximum subscriptions per client.";
     } else if (strcmp(key, "pow_min_difficulty") == 0) {
         description = "This sets the minimum proof-of-work difficulty required.";
+    } else if (strcmp(key, "idle_connection_timeout_sec") == 0) {
+        description = "Seconds before an idle connection (no REQ/EVENT) is closed and IP flagged. 0 to disable.";
+    } else if (strcmp(key, "idle_ban_enabled") == 0) {
+        description = "Whether to ban IPs that repeatedly connect without sending REQ or EVENT.";
+    } else if (strcmp(key, "idle_ban_threshold") == 0) {
+        description = "Number of idle/early-disconnect failures before banning an IP.";
+    } else if (strcmp(key, "idle_ban_window_sec") == 0) {
+        description = "Time window in seconds for counting idle failures.";
+    } else if (strcmp(key, "idle_ban_duration_sec") == 0) {
+        description = "Initial ban duration in seconds for idle failures (doubles each time).";
     } else if (strstr(key, "relay_") == key) {
         description = "This changes relay metadata information.";
     }

src/config.c

@@ -952,6 +952,20 @@ static int validate_config_field(const char* key, const char* value, char* error
         return 0;
     }
 
+    // Debug level (0-5)
+    if (strcmp(key, "debug_level") == 0) {
+        if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {
+            snprintf(error_msg, error_size, "invalid debug_level '%s' (must be 0-5)", value);
+            return -1;
+        }
+        int val = atoi(value);
+        if (val < 0 || val > 5) {
+            snprintf(error_msg, error_size, "debug_level '%s' out of range (0-5)", value);
+            return -1;
+        }
+        return 0;
+    }
+
     // IP auth failure ban settings
     if (strcmp(key, "auth_fail_ban_enabled") == 0) {
         if (!is_valid_boolean(value)) {
@@ -970,6 +984,67 @@ static int validate_config_field(const char* key, const char* value, char* error
         return 0;
     }
 
+    // Idle connection ban settings
+    if (strcmp(key, "idle_connection_timeout_sec") == 0) {
+        if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {
+            snprintf(error_msg, error_size, "invalid idle_connection_timeout_sec '%s' (must be non-negative integer)", value);
+            return -1;
+        }
+        int timeout = atoi(value);
+        if (timeout < 0 || timeout > 300) {
+            snprintf(error_msg, error_size, "idle_connection_timeout_sec must be between 0 and 300 seconds");
+            return -1;
+        }
+        return 0;
+    }
+
+    if (strcmp(key, "idle_ban_enabled") == 0) {
+        if (!is_valid_boolean(value)) {
+            snprintf(error_msg, error_size, "invalid boolean value '%s' for idle_ban_enabled", value);
+            return -1;
+        }
+        return 0;
+    }
+
+    if (strcmp(key, "idle_ban_threshold") == 0) {
+        if (!is_valid_positive_integer(value)) {
+            snprintf(error_msg, error_size, "invalid idle_ban_threshold '%s' (must be positive integer)", value);
+            return -1;
+        }
+        int threshold = atoi(value);
+        if (threshold < 1 || threshold > 100) {
+            snprintf(error_msg, error_size, "idle_ban_threshold must be between 1 and 100");
+            return -1;
+        }
+        return 0;
+    }
+
+    if (strcmp(key, "idle_ban_window_sec") == 0) {
+        if (!is_valid_positive_integer(value)) {
+            snprintf(error_msg, error_size, "invalid idle_ban_window_sec '%s' (must be positive integer)", value);
+            return -1;
+        }
+        int window = atoi(value);
+        if (window < 10 || window > 3600) {
+            snprintf(error_msg, error_size, "idle_ban_window_sec must be between 10 and 3600");
+            return -1;
+        }
+        return 0;
+    }
+
+    if (strcmp(key, "idle_ban_duration_sec") == 0) {
+        if (!is_valid_positive_integer(value)) {
+            snprintf(error_msg, error_size, "invalid idle_ban_duration_sec '%s' (must be positive integer)", value);
+            return -1;
+        }
+        int duration = atoi(value);
+        if (duration < 60 || duration > 86400) {
+            snprintf(error_msg, error_size, "idle_ban_duration_sec must be between 60 and 86400");
+            return -1;
+        }
+        return 0;
+    }
+
     // NIP-42 auth timeout
     if (strcmp(key, "nip42_auth_timeout_sec") == 0) {
         if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {

src/default_config_event.h

@@ -83,6 +83,10 @@ static const struct {
     // IP-based rate limiting or access control (which would require firewall protection anyway)
     {"trust_proxy_headers", "true"},
 
+    // Debug Level (0=none, 1=errors, 2=warnings, 3=info, 4=debug, 5=trace)
+    // Can be changed at runtime without restart via config_set admin command
+    {"debug_level", "3"},
+
     // IP Auth Failure Ban Settings
     // Ban IPs that repeatedly fail NIP-42 authentication
     {"auth_fail_ban_enabled", "true"},
@@ -95,6 +99,14 @@ static const struct {
     // Prevents unauthenticated connections from accumulating under heavy load
     {"nip42_auth_timeout_sec", "10"},
 
+    // Idle Connection Ban Settings
+    // Ban IPs that connect but never send REQ or EVENT (idle or early disconnect)
+    {"idle_connection_timeout_sec", "0"},   // Seconds before idle connection is closed (0 = disabled)
+    {"idle_ban_enabled", "false"},          // Whether to ban IPs with idle failures
+    {"idle_ban_threshold", "1"},            // Idle failures before ban (1 = ban on first offense)
+    {"idle_ban_window_sec", "30"},          // Window to count idle failures in
+    {"idle_ban_duration_sec", "300"},       // Initial ban duration (doubles each time, max 24h)
+
     // SQLite Performance Tuning
     // mmap_size: bytes of database file to memory-map (0 = disabled, 268435456 = 256MB recommended)
     // Eliminates pread64 syscall overhead for database reads — significant CPU savings under load

src/ip_ban.c

@@ -12,18 +12,37 @@
 // Fixed-size open-addressing hash table. No malloc after init.
 // Thread-safe via a single mutex (low contention — only called
 // at connection open/close, not in the hot event path).
+//
+// State is persisted to the ip_bans SQLite table every 5 minutes
+// and loaded at startup so bans survive relay restarts.
 // ============================================================
 
-#define IP_BAN_EMPTY    0   // slot is unused
-#define IP_BAN_ACTIVE   1   // slot has an entry
+#define IP_BAN_EMPTY    0
+#define IP_BAN_ACTIVE   1
 
 typedef struct {
-    int state;                  // IP_BAN_EMPTY or IP_BAN_ACTIVE
-    char ip[46];                // IPv4 or IPv6 string
-    int failure_count;          // total failures in current window
-    time_t first_failure;       // start of current failure window
-    time_t banned_until;        // 0 = not banned; >0 = banned until this time
-    int ban_count;              // how many times this IP has been banned (for backoff)
+    int state;                      // IP_BAN_EMPTY or IP_BAN_ACTIVE
+    char ip[46];                    // IPv4 or IPv6 string
+    
+    // Auth failure tracking (existing)
+    int failure_count;              // failures in current window
+    time_t first_failure;           // start of current failure window
+    time_t banned_until;            // 0 = not banned
+    int ban_count;                  // escalation level (for exponential backoff)
+    
+    // NEW: Idle failure tracking (separate)
+    int idle_failure_count;
+    time_t idle_first_failure;
+    time_t idle_banned_until;
+    int idle_ban_count;
+    
+    // Other existing fields
+    int has_authed_successfully;    // 1 if this IP has ever authenticated
+    time_t last_success_at;         // timestamp of last successful auth
+    int total_connections;          // lifetime connection count
+    int total_failures;             // lifetime auth failure count
+    int total_successes;            // lifetime successful auth count
+    time_t first_seen;              // when this IP was first seen
 } ip_ban_entry_t;
 
 static ip_ban_entry_t g_ban_table[IP_BAN_TABLE_SIZE];
@@ -41,19 +60,36 @@ static unsigned int ip_hash(const char* ip) {
 }
 
 // Find slot for IP (open addressing with linear probing)
-// Returns index of existing entry or first empty slot, -1 if table full
 static int find_slot(const char* ip) {
     unsigned int start = ip_hash(ip);
     for (unsigned int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
         unsigned int idx = (start + i) % IP_BAN_TABLE_SIZE;
         if (g_ban_table[idx].state == IP_BAN_EMPTY) {
-            return (int)idx;  // empty slot — can insert here
+            return (int)idx;
         }
         if (strcmp(g_ban_table[idx].ip, ip) == 0) {
-            return (int)idx;  // found existing entry
+            return (int)idx;
         }
     }
-    return -1;  // table full (shouldn't happen with 4096 slots)
+    return -1;
+}
+
+// Get or create an entry for an IP. Returns NULL if table is full.
+// Caller must hold g_ban_mutex.
+static ip_ban_entry_t* get_or_create_entry(const char* ip) {
+    int idx = find_slot(ip);
+    if (idx < 0) {
+        DEBUG_WARN("IP ban table full, cannot track %s", ip);
+        return NULL;
+    }
+    ip_ban_entry_t* entry = &g_ban_table[idx];
+    if (entry->state == IP_BAN_EMPTY) {
+        entry->state = IP_BAN_ACTIVE;
+        strncpy(entry->ip, ip, sizeof(entry->ip) - 1);
+        entry->ip[sizeof(entry->ip) - 1] = '\0';
+        entry->first_seen = time(NULL);
+    }
+    return entry;
 }
 
 void ip_ban_init(void) {
@@ -64,38 +100,234 @@ void ip_ban_init(void) {
     DEBUG_LOG("IP ban table initialized (%d slots)", IP_BAN_TABLE_SIZE);
 }
 
+void ip_ban_load_from_db(sqlite3* db) {
+    if (!db || !g_initialized) return;
+
+    // Create table if it doesn't exist (handles existing databases)
+    const char* create_sql =
+        "CREATE TABLE IF NOT EXISTS ip_bans ("
+        "  ip TEXT PRIMARY KEY,"
+        "  failure_count INTEGER NOT NULL DEFAULT 0,"
+        "  ban_count INTEGER NOT NULL DEFAULT 0,"
+        "  banned_until INTEGER NOT NULL DEFAULT 0,"
+        "  first_failure INTEGER NOT NULL DEFAULT 0,"
+        "  has_authed_successfully INTEGER NOT NULL DEFAULT 0,"
+        "  last_success_at INTEGER NOT NULL DEFAULT 0,"
+        "  total_connections INTEGER NOT NULL DEFAULT 0,"
+        "  total_failures INTEGER NOT NULL DEFAULT 0,"
+        "  total_successes INTEGER NOT NULL DEFAULT 0,"
+        "  first_seen INTEGER NOT NULL DEFAULT 0,"
+        "  updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))"
+        ");";
+    char* err = NULL;
+    if (sqlite3_exec(db, create_sql, NULL, NULL, &err) != SQLITE_OK) {
+        DEBUG_ERROR("Failed to create ip_bans table: %s", err ? err : "unknown");
+        if (err) sqlite3_free(err);
+        return;
+    }
+
+    // Migration: Add idle_* columns if they don't exist (ignore errors if already exists)
+    sqlite3_exec(db, "ALTER TABLE ip_bans ADD COLUMN idle_failure_count INTEGER NOT NULL DEFAULT 0", NULL, NULL, NULL);
+    sqlite3_exec(db, "ALTER TABLE ip_bans ADD COLUMN idle_ban_count INTEGER NOT NULL DEFAULT 0", NULL, NULL, NULL);
+    sqlite3_exec(db, "ALTER TABLE ip_bans ADD COLUMN idle_banned_until INTEGER NOT NULL DEFAULT 0", NULL, NULL, NULL);
+    sqlite3_exec(db, "ALTER TABLE ip_bans ADD COLUMN idle_first_failure INTEGER NOT NULL DEFAULT 0", NULL, NULL, NULL);
+
+    const char* sql =
+        "SELECT ip, failure_count, ban_count, banned_until, first_failure,"
+        "       has_authed_successfully, last_success_at, total_connections,"
+        "       total_failures, total_successes, first_seen,"
+        "       idle_failure_count, idle_ban_count, idle_banned_until, idle_first_failure"
+        " FROM ip_bans";
+
+    sqlite3_stmt* stmt;
+    if (sqlite3_prepare_v2(db, sql, -1, &stmt, NULL) != SQLITE_OK) {
+        DEBUG_ERROR("Failed to prepare ip_bans load query");
+        return;
+    }
+
+    int loaded = 0;
+    pthread_mutex_lock(&g_ban_mutex);
+    while (sqlite3_step(stmt) == SQLITE_ROW) {
+        const char* ip = (const char*)sqlite3_column_text(stmt, 0);
+        if (!ip) continue;
+
+        int idx = find_slot(ip);
+        if (idx < 0) continue;
+
+        ip_ban_entry_t* entry = &g_ban_table[idx];
+        entry->state = IP_BAN_ACTIVE;
+        strncpy(entry->ip, ip, sizeof(entry->ip) - 1);
+        entry->ip[sizeof(entry->ip) - 1] = '\0';
+        entry->failure_count          = sqlite3_column_int(stmt, 1);
+        entry->ban_count              = sqlite3_column_int(stmt, 2);
+        entry->banned_until           = (time_t)sqlite3_column_int64(stmt, 3);
+        entry->first_failure          = (time_t)sqlite3_column_int64(stmt, 4);
+        entry->has_authed_successfully = sqlite3_column_int(stmt, 5);
+        entry->last_success_at        = (time_t)sqlite3_column_int64(stmt, 6);
+        entry->total_connections      = sqlite3_column_int(stmt, 7);
+        entry->total_failures         = sqlite3_column_int(stmt, 8);
+        entry->total_successes        = sqlite3_column_int(stmt, 9);
+        entry->first_seen             = (time_t)sqlite3_column_int64(stmt, 10);
+        // Load idle tracking fields (default to 0 if columns don't exist yet)
+        entry->idle_failure_count     = sqlite3_column_int(stmt, 11);
+        entry->idle_ban_count         = sqlite3_column_int(stmt, 12);
+        entry->idle_banned_until      = (time_t)sqlite3_column_int64(stmt, 13);
+        entry->idle_first_failure     = (time_t)sqlite3_column_int64(stmt, 14);
+        loaded++;
+    }
+    pthread_mutex_unlock(&g_ban_mutex);
+    sqlite3_finalize(stmt);
+
+    // Count how many are still actively banned
+    time_t now = time(NULL);
+    int still_banned = 0;
+    pthread_mutex_lock(&g_ban_mutex);
+    for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
+        if (g_ban_table[i].state == IP_BAN_ACTIVE &&
+            g_ban_table[i].banned_until > now) {
+            still_banned++;
+        }
+    }
+    pthread_mutex_unlock(&g_ban_mutex);
+
+    DEBUG_WARN("IP ban table loaded: %d IPs restored (%d still banned)", loaded, still_banned);
+}
+
+void ip_ban_save_to_db(sqlite3* db) {
+    if (!db || !g_initialized) return;
+
+    const char* upsert_sql =
+        "INSERT OR REPLACE INTO ip_bans"
+        " (ip, failure_count, ban_count, banned_until, first_failure,"
+        "  has_authed_successfully, last_success_at, total_connections,"
+        "  total_failures, total_successes, first_seen, updated_at,"
+        "  idle_failure_count, idle_ban_count, idle_banned_until, idle_first_failure)"
+        " VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%s', 'now'), ?, ?, ?, ?)";
+
+    sqlite3_stmt* stmt;
+    if (sqlite3_prepare_v2(db, upsert_sql, -1, &stmt, NULL) != SQLITE_OK) {
+        DEBUG_ERROR("Failed to prepare ip_bans save query");
+        return;
+    }
+
+    sqlite3_exec(db, "BEGIN TRANSACTION", NULL, NULL, NULL);
+
+    int saved = 0;
+    pthread_mutex_lock(&g_ban_mutex);
+    for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
+        ip_ban_entry_t* entry = &g_ban_table[i];
+        if (entry->state != IP_BAN_ACTIVE) continue;
+
+        sqlite3_reset(stmt);
+        sqlite3_bind_text(stmt, 1, entry->ip, -1, SQLITE_STATIC);
+        sqlite3_bind_int(stmt, 2, entry->failure_count);
+        sqlite3_bind_int(stmt, 3, entry->ban_count);
+        sqlite3_bind_int64(stmt, 4, (sqlite3_int64)entry->banned_until);
+        sqlite3_bind_int64(stmt, 5, (sqlite3_int64)entry->first_failure);
+        sqlite3_bind_int(stmt, 6, entry->has_authed_successfully);
+        sqlite3_bind_int64(stmt, 7, (sqlite3_int64)entry->last_success_at);
+        sqlite3_bind_int(stmt, 8, entry->total_connections);
+        sqlite3_bind_int(stmt, 9, entry->total_failures);
+        sqlite3_bind_int(stmt, 10, entry->total_successes);
+        sqlite3_bind_int64(stmt, 11, (sqlite3_int64)entry->first_seen);
+        // Idle tracking fields
+        sqlite3_bind_int(stmt, 12, entry->idle_failure_count);
+        sqlite3_bind_int(stmt, 13, entry->idle_ban_count);
+        sqlite3_bind_int64(stmt, 14, (sqlite3_int64)entry->idle_banned_until);
+        sqlite3_bind_int64(stmt, 15, (sqlite3_int64)entry->idle_first_failure);
+
+        if (sqlite3_step(stmt) != SQLITE_DONE) {
+            DEBUG_WARN("Failed to save ip_ban entry for %s", entry->ip);
+        } else {
+            saved++;
+        }
+    }
+    pthread_mutex_unlock(&g_ban_mutex);
+
+    sqlite3_finalize(stmt);
+    sqlite3_exec(db, "COMMIT", NULL, NULL, NULL);
+
+    DEBUG_TRACE("IP ban table saved: %d entries written to DB", saved);
+}
+
+// Check if an IP is in the idle_ban_whitelist config (comma-separated list)
+static int ip_is_whitelisted(const char* ip) {
+    const char* whitelist = get_config_value("idle_ban_whitelist");
+    if (!whitelist || whitelist[0] == '\0') return 0;
+
+    // Make a mutable copy to tokenize
+    char buf[1024];
+    strncpy(buf, whitelist, sizeof(buf) - 1);
+    buf[sizeof(buf) - 1] = '\0';
+
+    char* token = strtok(buf, ",");
+    while (token) {
+        // Trim leading/trailing spaces
+        while (*token == ' ') token++;
+        char* end = token + strlen(token) - 1;
+        while (end > token && *end == ' ') { *end = '\0'; end--; }
+        if (strcmp(token, ip) == 0) return 1;
+        token = strtok(NULL, ",");
+    }
+    return 0;
+}
+
 int ip_ban_is_banned(const char* ip) {
     if (!ip || !g_initialized) return 0;
 
-    // Check if feature is enabled
-    if (!get_config_bool("auth_fail_ban_enabled", 1)) return 0;
+    // Whitelisted IPs are never banned
+    if (ip_is_whitelisted(ip)) return 0;
 
     pthread_mutex_lock(&g_ban_mutex);
-
     int idx = find_slot(ip);
     if (idx < 0 || g_ban_table[idx].state == IP_BAN_EMPTY) {
         pthread_mutex_unlock(&g_ban_mutex);
-        return 0;  // no entry — not banned
+        return 0;
     }
 
     ip_ban_entry_t* entry = &g_ban_table[idx];
     time_t now = time(NULL);
+    int banned = 0;
 
-    if (entry->banned_until > 0 && now < entry->banned_until) {
-        pthread_mutex_unlock(&g_ban_mutex);
-        DEBUG_TRACE("IP %s is banned for %ld more seconds", ip, entry->banned_until - now);
-        return 1;  // still banned
+    // Check auth ban (if enabled)
+    if (get_config_bool("auth_fail_ban_enabled", 1) &&
+        entry->banned_until > 0 && now < entry->banned_until) {
+        banned = 1;
     }
 
-    // Ban expired — clear it but keep the entry for failure tracking
-    if (entry->banned_until > 0 && now >= entry->banned_until) {
-        entry->banned_until = 0;
-        entry->failure_count = 0;
-        entry->first_failure = 0;
+    // Check idle ban (if enabled)
+    if (get_config_bool("idle_ban_enabled", 1) &&
+        entry->idle_banned_until > 0 && now < entry->idle_banned_until) {
+        banned = 1;
+    }
+
+    // Clear expired bans
+    if (!banned) {
+        if (entry->banned_until > 0 && now >= entry->banned_until) {
+            entry->banned_until = 0;
+            entry->failure_count = 0;
+            entry->first_failure = 0;
+        }
+        if (entry->idle_banned_until > 0 && now >= entry->idle_banned_until) {
+            entry->idle_banned_until = 0;
+            entry->idle_failure_count = 0;
+            entry->idle_first_failure = 0;
+        }
     }
 
     pthread_mutex_unlock(&g_ban_mutex);
-    return 0;
+    return banned;
+}
+
+void ip_ban_record_connection(const char* ip) {
+    if (!ip || !g_initialized) return;
+
+    pthread_mutex_lock(&g_ban_mutex);
+    ip_ban_entry_t* entry = get_or_create_entry(ip);
+    if (entry) {
+        entry->total_connections++;
+    }
+    pthread_mutex_unlock(&g_ban_mutex);
 }
 
 void ip_ban_record_failure(const char* ip) {
@@ -107,41 +339,29 @@ void ip_ban_record_failure(const char* ip) {
     int ban_duration = get_config_int("auth_fail_ban_duration_sec", 300);
 
     pthread_mutex_lock(&g_ban_mutex);
-
-    int idx = find_slot(ip);
-    if (idx < 0) {
-        // Table full — can't track this IP, just log and return
-        DEBUG_WARN("IP ban table full, cannot track %s", ip);
+    ip_ban_entry_t* entry = get_or_create_entry(ip);
+    if (!entry) {
         pthread_mutex_unlock(&g_ban_mutex);
         return;
     }
 
-    ip_ban_entry_t* entry = &g_ban_table[idx];
     time_t now = time(NULL);
 
-    if (entry->state == IP_BAN_EMPTY) {
-        // New entry
-        entry->state = IP_BAN_ACTIVE;
-        strncpy(entry->ip, ip, sizeof(entry->ip) - 1);
-        entry->ip[sizeof(entry->ip) - 1] = '\0';
-        entry->failure_count = 0;
-        entry->first_failure = now;
-        entry->banned_until = 0;
-        entry->ban_count = 0;
-    }
-
-    // Reset window if it's expired
+    // Reset window if expired
     if (entry->first_failure > 0 && (now - entry->first_failure) > window_sec) {
         entry->failure_count = 0;
         entry->first_failure = now;
     }
+    if (entry->first_failure == 0) {
+        entry->first_failure = now;
+    }
 
     entry->failure_count++;
+    entry->total_failures++;
 
     DEBUG_TRACE("IP %s auth failure count: %d/%d", ip, entry->failure_count, threshold);
 
     if (entry->failure_count >= threshold) {
-        // Apply exponential backoff: ban_duration * 2^ban_count, capped at 24 hours
         int duration = ban_duration;
         for (int i = 0; i < entry->ban_count && duration < 86400; i++) {
             duration *= 2;
@@ -150,7 +370,7 @@ void ip_ban_record_failure(const char* ip) {
 
         entry->banned_until = now + duration;
         entry->ban_count++;
-        entry->failure_count = 0;  // reset counter after ban
+        entry->failure_count = 0;
         entry->first_failure = 0;
 
         DEBUG_WARN("IP %s banned for %d seconds (ban #%d) after %d auth failures",
@@ -160,20 +380,71 @@ void ip_ban_record_failure(const char* ip) {
     pthread_mutex_unlock(&g_ban_mutex);
 }
 
+// Record an idle/early-disconnect failure for an IP
+void ip_ban_record_idle_failure(const char* ip) {
+    if (!ip || !g_initialized) return;
+    if (!get_config_bool("idle_ban_enabled", 1)) return;
+    if (ip_is_whitelisted(ip)) return;  // Never record idle failures for whitelisted IPs
+
+    int threshold = get_config_int("idle_ban_threshold", 1);
+    int window_sec = get_config_int("idle_ban_window_sec", 30);
+    int ban_duration = get_config_int("idle_ban_duration_sec", 300);
+
+    pthread_mutex_lock(&g_ban_mutex);
+    ip_ban_entry_t* entry = get_or_create_entry(ip);
+    if (!entry) {
+        pthread_mutex_unlock(&g_ban_mutex);
+        return;
+    }
+
+    time_t now = time(NULL);
+
+    // Reset window if expired
+    if (entry->idle_first_failure > 0 && (now - entry->idle_first_failure) > window_sec) {
+        entry->idle_failure_count = 0;
+        entry->idle_first_failure = now;
+    }
+    if (entry->idle_first_failure == 0) {
+        entry->idle_first_failure = now;
+    }
+
+    entry->idle_failure_count++;
+    entry->total_failures++;
+
+    DEBUG_TRACE("IP %s idle failure count: %d/%d", ip, entry->idle_failure_count, threshold);
+
+    if (entry->idle_failure_count >= threshold) {
+        int duration = ban_duration;
+        for (int i = 0; i < entry->idle_ban_count && duration < 86400; i++) {
+            duration *= 2;
+        }
+        if (duration > 86400) duration = 86400;
+
+        entry->idle_banned_until = now + duration;
+        entry->idle_ban_count++;
+        entry->idle_failure_count = 0;
+        entry->idle_first_failure = 0;
+
+        DEBUG_WARN("IP %s banned for %d seconds (idle ban #%d) after %d idle failures",
+                   ip, duration, entry->idle_ban_count, threshold);
+    }
+
+    pthread_mutex_unlock(&g_ban_mutex);
+}
+
 void ip_ban_record_success(const char* ip) {
     if (!ip || !g_initialized) return;
 
     pthread_mutex_lock(&g_ban_mutex);
-
-    int idx = find_slot(ip);
-    if (idx >= 0 && g_ban_table[idx].state == IP_BAN_ACTIVE) {
-        // Clear failure count on successful auth — reward good behavior
-        g_ban_table[idx].failure_count = 0;
-        g_ban_table[idx].first_failure = 0;
-        // Note: we keep ban_count so backoff persists across sessions
+    ip_ban_entry_t* entry = get_or_create_entry(ip);
+    if (entry) {
+        entry->failure_count = 0;
+        entry->first_failure = 0;
+        entry->has_authed_successfully = 1;
+        entry->last_success_at = time(NULL);
+        entry->total_successes++;
         DEBUG_TRACE("IP %s authenticated successfully — failure count cleared", ip);
     }
-
     pthread_mutex_unlock(&g_ban_mutex);
 }
 
@@ -181,37 +452,54 @@ void ip_ban_cleanup(void) {
     if (!g_initialized) return;
 
     pthread_mutex_lock(&g_ban_mutex);
-
     time_t now = time(NULL);
     int window_sec = get_config_int("auth_fail_window_sec", 60);
+    int idle_window_sec = get_config_int("idle_ban_window_sec", 60);
     int cleaned = 0;
 
     for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
         if (g_ban_table[i].state != IP_BAN_ACTIVE) continue;
-
         ip_ban_entry_t* entry = &g_ban_table[i];
 
-        // Clear entries where ban has expired AND failure window has expired AND no recent activity
-        int ban_expired = (entry->banned_until == 0 || now >= entry->banned_until);
-        int window_expired = (entry->first_failure == 0 || (now - entry->first_failure) > window_sec * 10);
+        // Check auth failure window expiration
+        int auth_ban_expired = (entry->banned_until == 0 || now >= entry->banned_until);
+        int auth_window_expired = (entry->first_failure == 0 || (now - entry->first_failure) > window_sec * 10);
 
-        if (ban_expired && window_expired && entry->failure_count == 0) {
-            // Retain ban_count for 24 hours after the last ban expired.
-            // This ensures exponential backoff persists if the IP returns within 24 hours.
-            // After 24 hours of inactivity, fully clean the entry.
+        // Check idle failure window expiration
+        int idle_ban_expired = (entry->idle_banned_until == 0 || now >= entry->idle_banned_until);
+        int idle_window_expired = (entry->idle_first_failure == 0 || (now - entry->idle_first_failure) > idle_window_sec * 10);
+
+        if (auth_ban_expired && auth_window_expired && entry->failure_count == 0 &&
+            idle_ban_expired && idle_window_expired && entry->idle_failure_count == 0) {
             int retain_sec = 86400; // 24 hours
-            int last_ban_expired_long_ago = (entry->banned_until == 0 ||
-                                             (now - entry->banned_until) > retain_sec);
+            int last_auth_ban_expired_long_ago = (entry->banned_until == 0 ||
+                                                   (now - entry->banned_until) > retain_sec);
+            int last_idle_ban_expired_long_ago = (entry->idle_banned_until == 0 ||
+                                                   (now - entry->idle_banned_until) > retain_sec);
 
-            if (last_ban_expired_long_ago) {
-                // Fully clean — IP has been gone for 24+ hours, start fresh if it returns
+            if (last_auth_ban_expired_long_ago && last_idle_ban_expired_long_ago &&
+                !entry->has_authed_successfully &&
+                entry->ban_count == 0 && entry->idle_ban_count == 0 &&
+                entry->total_connections <= 1) {
+                // Fully clean — never banned, never authenticated, only seen once
                 memset(entry, 0, sizeof(ip_ban_entry_t));
                 cleaned++;
             } else {
-                // Keep entry alive but reset transient fields — preserve ban_count
+                // Keep entry permanently — preserve ban_count for escalation.
+                // An IP that has been banned before will always get at least a 24-hour ban
+                // if it fails auth again, regardless of how long it has been away.
                 entry->failure_count = 0;
                 entry->first_failure = 0;
-                // banned_until and ban_count preserved intentionally
+                entry->idle_failure_count = 0;
+                entry->idle_first_failure = 0;
+                if (last_auth_ban_expired_long_ago) {
+                    entry->banned_until = 0;
+                    // ban_count intentionally NOT reset — permanent escalation
+                }
+                if (last_idle_ban_expired_long_ago) {
+                    entry->idle_banned_until = 0;
+                    // idle_ban_count intentionally NOT reset — permanent escalation
+                }
             }
         }
     }
@@ -219,19 +507,19 @@ void ip_ban_cleanup(void) {
     if (cleaned > 0) {
         DEBUG_TRACE("IP ban cleanup: freed %d stale entries", cleaned);
     }
-
     pthread_mutex_unlock(&g_ban_mutex);
 }
 
 int ip_ban_get_banned_count(void) {
     if (!g_initialized) return 0;
-
     pthread_mutex_lock(&g_ban_mutex);
     time_t now = time(NULL);
     int count = 0;
     for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
-        if (g_ban_table[i].state == IP_BAN_ACTIVE &&
-            g_ban_table[i].banned_until > now) {
+        if (g_ban_table[i].state != IP_BAN_ACTIVE) continue;
+        // Count if either auth banned or idle banned
+        if (g_ban_table[i].banned_until > now ||
+            g_ban_table[i].idle_banned_until > now) {
             count++;
         }
     }
@@ -241,7 +529,6 @@ int ip_ban_get_banned_count(void) {
 
 int ip_ban_get_tracked_count(void) {
     if (!g_initialized) return 0;
-
     pthread_mutex_lock(&g_ban_mutex);
     int count = 0;
     for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
@@ -251,41 +538,38 @@ int ip_ban_get_tracked_count(void) {
     return count;
 }
 
-// Emit a periodic log summary of banned IPs.
-// Call from the connection age checker (runs every ~30s).
-// Only logs when there are active bans or when the interval has elapsed.
-void ip_ban_log_stats(void) {
+void ip_ban_log_stats(sqlite3* db) {
     if (!g_initialized) return;
 
     static time_t last_log = 0;
     time_t now = time(NULL);
 
-    // Log every 5 minutes
     if (now - last_log < 300) return;
     last_log = now;
 
-    pthread_mutex_lock(&g_ban_mutex);
+    // Save to DB every 5 minutes
+    if (db) {
+        ip_ban_save_to_db(db);
+    }
 
-    int banned_count = 0;
+    pthread_mutex_lock(&g_ban_mutex);
+    int auth_banned_count = 0;
+    int idle_banned_count = 0;
     int tracked_count = 0;
+    int trusted_count = 0;
 
     for (int i = 0; i < IP_BAN_TABLE_SIZE; i++) {
         if (g_ban_table[i].state != IP_BAN_ACTIVE) continue;
         tracked_count++;
-        if (g_ban_table[i].banned_until > now) {
-            banned_count++;
-            DEBUG_WARN("IP BAN: %s banned for %ld more seconds (ban #%d, failures: %d)",
-                       g_ban_table[i].ip,
-                       g_ban_table[i].banned_until - now,
-                       g_ban_table[i].ban_count,
-                       g_ban_table[i].failure_count);
-        }
+        if (g_ban_table[i].banned_until > now) auth_banned_count++;
+        if (g_ban_table[i].idle_banned_until > now) idle_banned_count++;
+        if (g_ban_table[i].has_authed_successfully) trusted_count++;
     }
-
     pthread_mutex_unlock(&g_ban_mutex);
 
-    if (banned_count > 0 || tracked_count > 0) {
-        DEBUG_WARN("IP BAN SUMMARY: %d IPs currently banned, %d IPs tracked",
-                   banned_count, tracked_count);
+    int total_banned = auth_banned_count + idle_banned_count;
+    if (total_banned > 0 || tracked_count > 0) {
+        DEBUG_WARN("IP BAN SUMMARY: %d auth-banned, %d idle-banned, %d tracked, %d trusted (ever authed)",
+                   auth_banned_count, idle_banned_count, tracked_count, trusted_count);
     }
 }

src/ip_ban.h

@@ -5,7 +5,8 @@
 //
 // Tracks auth failures per IP address and temporarily bans IPs that repeatedly
 // fail NIP-42 authentication. Uses an in-memory fixed-size hash table — no
-// database writes, no root required, no persistent state.
+// database writes on the hot path. State is persisted to the ip_bans table
+// every 5 minutes and loaded at startup.
 //
 // Config keys (all read from the config table at runtime):
 //   auth_fail_ban_enabled      bool  default: true   (0 = disabled)
@@ -14,13 +15,22 @@
 //   auth_fail_ban_duration_sec int   default: 300     (initial ban duration, doubles each time)
 
 #include <time.h>
+#include <sqlite3.h>
 
 // Maximum number of IPs tracked simultaneously (fixed-size, no malloc)
 #define IP_BAN_TABLE_SIZE 4096
 
-// Initialize the IP ban table (call once at startup)
+// Initialize the IP ban table (call once at startup, before loading from DB)
 void ip_ban_init(void);
 
+// Load ban state from the ip_bans database table.
+// Call after ip_ban_init() and after the database is open.
+void ip_ban_load_from_db(sqlite3* db);
+
+// Save current ban state to the ip_bans database table.
+// Called every 5 minutes from the maintenance timer.
+void ip_ban_save_to_db(sqlite3* db);
+
 // Check if an IP is currently banned.
 // Returns 1 if banned (connection should be rejected), 0 if allowed.
 int ip_ban_is_banned(const char* ip);
@@ -30,19 +40,27 @@ int ip_ban_is_banned(const char* ip);
 // May trigger a ban if the threshold is exceeded.
 void ip_ban_record_failure(const char* ip);
 
+// Record an idle/early-disconnect failure for an IP.
+// Called when a connection closes without ever sending REQ or EVENT.
+// May trigger a ban if the threshold is exceeded.
+void ip_ban_record_idle_failure(const char* ip);
+
 // Record a successful auth for an IP.
-// Clears any failure count for this IP (reward good behavior).
+// Sets has_authed_successfully=1 and clears failure count.
 void ip_ban_record_success(const char* ip);
 
+// Record a new connection from an IP (increment total_connections).
+void ip_ban_record_connection(const char* ip);
+
 // Periodic cleanup: expire old entries (call from the connection age checker).
 void ip_ban_cleanup(void);
 
+// Emit a periodic WARN-level log summary of banned IPs (every 5 minutes).
+// Also saves state to DB.
+void ip_ban_log_stats(sqlite3* db);
+
 // Get stats for logging/monitoring
 int ip_ban_get_banned_count(void);
 int ip_ban_get_tracked_count(void);
 
-// Emit a periodic WARN-level log summary of banned IPs (every 5 minutes).
-// Call from the connection age checker timer.
-void ip_ban_log_stats(void);
-
 #endif // IP_BAN_H

src/main.c

@@ -162,8 +162,9 @@ int handle_nip11_http_request(struct lws* wsi, const char* accept_header);
 // Forward declaration for WebSocket relay server
 int start_websocket_relay(int port_override, int strict_port);
 
-// Forward declaration for IP ban system
+// Forward declarations for IP ban system
 void ip_ban_init(void);
+void ip_ban_load_from_db(sqlite3* db);
 
 
 // Forward declarations for NIP-13 PoW handling (now in nip013.c)
@@ -185,6 +186,53 @@ int validate_event_expiration(cJSON* event, char* error_message, size_t error_si
 
 // Logging functions - REMOVED (replaced by debug system in debug.c)
 
+static void nostr_log_cb(int level, const char* component, const char* message, void* user_data) {
+    (void)user_data;
+
+    const char* comp = (component && component[0]) ? component : "core";
+    const char* msg = message ? message : "";
+
+    switch (level) {
+        case NOSTR_LOG_LEVEL_ERROR:
+            DEBUG_ERROR("[nostr:%s] %s", comp, msg);
+            break;
+        case NOSTR_LOG_LEVEL_WARN:
+            DEBUG_WARN("[nostr:%s] %s", comp, msg);
+            break;
+        case NOSTR_LOG_LEVEL_INFO:
+            DEBUG_INFO("[nostr:%s] %s", comp, msg);
+            break;
+        case NOSTR_LOG_LEVEL_DEBUG:
+            DEBUG_LOG("[nostr:%s] %s", comp, msg);
+            break;
+        case NOSTR_LOG_LEVEL_TRACE:
+        default:
+            DEBUG_TRACE("[nostr:%s] %s", comp, msg);
+            break;
+    }
+}
+
+static nostr_log_level_t nostr_log_level_from_debug_level(int debug_level) {
+    if (debug_level >= DEBUG_LEVEL_TRACE) {
+        return NOSTR_LOG_LEVEL_TRACE;
+    }
+    if (debug_level >= DEBUG_LEVEL_DEBUG) {
+        return NOSTR_LOG_LEVEL_DEBUG;
+    }
+    if (debug_level >= DEBUG_LEVEL_INFO) {
+        return NOSTR_LOG_LEVEL_INFO;
+    }
+    if (debug_level >= DEBUG_LEVEL_WARN) {
+        return NOSTR_LOG_LEVEL_WARN;
+    }
+    if (debug_level >= DEBUG_LEVEL_ERROR) {
+        return NOSTR_LOG_LEVEL_ERROR;
+    }
+
+    // Production-safe default for systemd/journald deployments.
+    return NOSTR_LOG_LEVEL_INFO;
+}
+
 // Update subscription manager configuration from config system
 void update_subscription_manager_config(void) {
     g_subscription_manager.max_subscriptions_per_client = get_config_int("max_subscriptions_per_client", MAX_SUBSCRIPTIONS_PER_CLIENT);
@@ -1259,6 +1307,13 @@ int handle_req_message(const char* sub_id, cJSON* filters, struct lws *wsi, stru
             continue;
         }
 
+        // NIP-01: limit:0 means return zero stored events — skip SQL entirely, just send EOSE
+        cJSON* limit_check = cJSON_GetObjectItemCaseSensitive(filter, "limit");
+        if (limit_check && cJSON_IsNumber(limit_check) && (int)cJSON_GetNumberValue(limit_check) == 0) {
+            DEBUG_LOG("Filter has limit:0 — skipping query, sending EOSE immediately (NIP-01 compliance)");
+            continue;
+        }
+
         // Reset bind params for this filter
         free_bind_params(bind_params, bind_param_count);
         bind_params = NULL;
@@ -1919,6 +1974,12 @@ int main(int argc, char* argv[]) {
 
     DEBUG_LOG("Nostr library initialized");
 
+    // Route nostr_core_lib logs into relay logging pipeline (stdout/stderr -> journald or relay.log)
+    nostr_set_log_callback(nostr_log_cb, NULL);
+    nostr_log_level_t nostr_level = nostr_log_level_from_debug_level(cli_options.debug_level);
+    nostr_set_log_level(nostr_level);
+    DEBUG_INFO("Nostr callback logging initialized at level %d", (int)nostr_level);
+
     // Check if this is first-time startup or existing relay
     if (is_first_time_startup()) {
         DEBUG_LOG("First-time startup detected");
@@ -2168,8 +2229,9 @@ int main(int argc, char* argv[]) {
     // Cleanup orphaned subscriptions from previous runs
     cleanup_all_subscriptions_on_startup();
     
-    // Initialize IP ban table before starting the relay
+    // Initialize IP ban table and load persisted state from database
     ip_ban_init();
+    ip_ban_load_from_db(g_db);
 
     // Start WebSocket Nostr relay server (port from CLI override or configuration)
     int result = start_websocket_relay(cli_options.port_override, cli_options.strict_port);  // Use CLI port override if specified, otherwise config
@@ -2183,6 +2245,7 @@ int main(int argc, char* argv[]) {
     pthread_mutex_destroy(&g_subscription_manager.subscriptions_lock);
     pthread_mutex_destroy(&g_subscription_manager.ip_tracking_lock);
 
+    nostr_set_log_callback(NULL, NULL);
     nostr_cleanup();
     close_database();
     

src/main.h

@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 24
-#define CRELAY_VERSION "v1.2.24"
+#define CRELAY_VERSION_PATCH 52
+#define CRELAY_VERSION "v1.2.52"
 
 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"

src/nip042.c

@@ -12,7 +12,9 @@
 #include <string.h>
 #include <stdlib.h>
 #include <time.h>
+#include <stdio.h>
 #include "websockets.h"
+#include "ip_ban.h"
 
 
 // Forward declaration for notice message function
@@ -93,8 +95,17 @@ void handle_nip42_auth_signed_event(struct lws* wsi, struct per_session_data* ps
     
     // Verify authentication using existing request_validator function
     // Note: nostr_nip42_verify_auth_event doesn't extract pubkey, we need to do that separately
+    char relay_url[RELAY_URL_MAX_LENGTH];
+    const char* configured_relay_url = get_config_value("relay_url");
+    if (configured_relay_url && configured_relay_url[0] != '\0') {
+        snprintf(relay_url, sizeof(relay_url), "%s", configured_relay_url);
+    } else {
+        int relay_port = (g_relay_port > 0) ? g_relay_port : get_config_int("relay_port", DEFAULT_PORT);
+        snprintf(relay_url, sizeof(relay_url), "ws://127.0.0.1:%d", relay_port);
+    }
+
     int result = nostr_nip42_verify_auth_event(auth_event, challenge_copy,
-                                               "ws://localhost:8888", 600); // 10 minutes tolerance
+                                               relay_url, 600); // 10 minutes tolerance
     
     char authenticated_pubkey[65] = {0};
     if (result == 0) {
@@ -125,11 +136,16 @@ void handle_nip42_auth_signed_event(struct lws* wsi, struct per_session_data* ps
         memset(pss->active_challenge, 0, sizeof(pss->active_challenge));
         pss->challenge_expires = 0;
         pss->auth_challenge_sent = 0;
+        // Mark session as active - client sent AUTH
+        pss->session_active = 1;
         pthread_mutex_unlock(&pss->session_lock);
 
         // Cancel the auth timeout — client has authenticated, keep connection open
         lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
-        
+
+        // Record successful auth for this IP — marks it as trusted
+        ip_ban_record_success(pss->client_ip);
+
         send_notice_message(wsi, pss, "NIP-42 authentication successful");
     } else {
         // Authentication failed

src/websockets.c

@@ -116,6 +116,86 @@ extern struct lws_context *ws_context;
 // Global subscription manager
 struct subscription_manager g_subscription_manager;
 
+// Actual relay port bound by libwebsockets at runtime (after fallback/retry logic)
+int g_relay_port = DEFAULT_PORT;
+
+// Global connection list for idle connection tracking
+// Tracks ALL WebSocket connections (not just subscribed ones)
+// so the periodic timer can find and close idle connections
+#define MAX_TRACKED_CONNECTIONS 4096
+
+typedef struct {
+    struct lws* wsi;
+    struct per_session_data* pss;
+} tracked_connection_t;
+
+static tracked_connection_t g_connections[MAX_TRACKED_CONNECTIONS];
+static int g_connection_count = 0;
+static pthread_mutex_t g_connections_lock = PTHREAD_MUTEX_INITIALIZER;
+
+int get_active_connection_count(void) { return g_connection_count; }
+
+static void connection_list_add(struct lws* wsi, struct per_session_data* pss) {
+    pthread_mutex_lock(&g_connections_lock);
+    for (int i = 0; i < MAX_TRACKED_CONNECTIONS; i++) {
+        if (g_connections[i].wsi == NULL) {
+            g_connections[i].wsi = wsi;
+            g_connections[i].pss = pss;
+            g_connection_count++;
+            break;
+        }
+    }
+    pthread_mutex_unlock(&g_connections_lock);
+}
+
+static void connection_list_remove(struct lws* wsi) {
+    pthread_mutex_lock(&g_connections_lock);
+    for (int i = 0; i < MAX_TRACKED_CONNECTIONS; i++) {
+        if (g_connections[i].wsi == wsi) {
+            g_connections[i].wsi = NULL;
+            g_connections[i].pss = NULL;
+            g_connection_count--;
+            break;
+        }
+    }
+    pthread_mutex_unlock(&g_connections_lock);
+}
+
+// Check all tracked connections for idle timeout and close them
+// Called from the periodic maintenance timer (every 60 seconds)
+static void check_idle_connections(int idle_timeout_sec) {
+    if (idle_timeout_sec <= 0) return;
+
+    time_t now = time(NULL);
+
+    // Collect WSIs to close outside the lock to avoid deadlock
+    struct lws* to_close[MAX_TRACKED_CONNECTIONS];
+    int close_count = 0;
+
+    pthread_mutex_lock(&g_connections_lock);
+    for (int i = 0; i < MAX_TRACKED_CONNECTIONS; i++) {
+        if (g_connections[i].wsi == NULL || g_connections[i].pss == NULL) continue;
+        struct per_session_data* pss = g_connections[i].pss;
+        if (pss->session_active) continue; // Already active — skip
+        if (pss->connection_established <= 0) continue;
+        time_t age = now - pss->connection_established;
+        if (age >= idle_timeout_sec) {
+            to_close[close_count++] = g_connections[i].wsi;
+        }
+    }
+    pthread_mutex_unlock(&g_connections_lock);
+
+    for (int i = 0; i < close_count; i++) {
+        // Get pss again safely — it may have been freed if connection closed between lock release and here
+        struct per_session_data* pss = (struct per_session_data*)lws_wsi_user(to_close[i]);
+        if (!pss) continue;
+        DEBUG_LOG("Closing idle connection from %s (no REQ/EVENT after %d seconds)",
+                  pss->client_ip, idle_timeout_sec);
+        lws_close_reason(to_close[i], LWS_CLOSE_STATUS_POLICY_VIOLATION,
+                         (unsigned char*)"Idle connection timeout", 23);
+    }
+}
+
 
 
 // Message queue functions for proper libwebsockets pattern
@@ -330,6 +410,12 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
     switch (reason) {
         case LWS_CALLBACK_HTTP:
             // Handle HTTP requests
+            // Mark session as active so HTTP requests don't trigger idle ban
+            if (pss) {
+                pthread_mutex_lock(&pss->session_lock);
+                pss->session_active = 1;
+                pthread_mutex_unlock(&pss->session_lock);
+            }
             {
                 char *requested_uri = (char *)in;
 
@@ -383,6 +469,12 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                         int is_nip11_request = (strstr(accept_header, "application/nostr+json") != NULL);
 
                         if (is_nip11_request) {
+                            // Mark session as active so HTTP requests don't trigger idle ban
+                            if (pss) {
+                                pthread_mutex_lock(&pss->session_lock);
+                                pss->session_active = 1;
+                                pthread_mutex_unlock(&pss->session_lock);
+                            }
                             // Handle NIP-11 request
                             if (handle_nip11_http_request(wsi, accept_header) == 0) {
                                 return 0; // Successfully handled
@@ -547,6 +639,15 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
             pss->challenge_created = 0;
             pss->challenge_expires = 0;
 
+            // Mark as WebSocket connection (not HTTP)
+            pss->is_websocket = 1;
+
+            // Register in global connection list for idle tracking
+            connection_list_add(wsi, pss);
+
+            // Record connection for stats tracking
+            ip_ban_record_connection(pss->client_ip);
+
             // Check IP ban using the resolved client IP (which may be from X-Forwarded-For).
             // This must happen AFTER pss->client_ip is populated so the same IP string
             // is used for both ban recording (at CLOSED) and ban checking (here).
@@ -555,16 +656,29 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                 return -1;  // Close connection immediately — no challenge, no processing
             }
 
-            // Set libwebsockets auth timeout: if NIP-42 auth is required and the client
-            // doesn't authenticate within nip42_auth_timeout_sec seconds, lws will close
-            // the connection automatically — even if the client never sends a message.
-            // This prevents idle unauthenticated connections from accumulating.
+            // Initialize session activity tracking
+            pss->session_active = 0;
+            pss->idle_timeout_sec = get_config_int("idle_connection_timeout_sec", 30);
+
+            // Set idle timeout for ALL connections (not just auth-required)
+            // This catches bots that connect and do nothing
+            if (pss->idle_timeout_sec > 0) {
+                lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, pss->idle_timeout_sec);
+                DEBUG_TRACE("Idle timeout set: %d seconds for connection from %s",
+                            pss->idle_timeout_sec, pss->client_ip);
+            }
+
+            // Also set auth timeout if auth is required (separate concern)
             if (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) {
                 int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
-                if (auth_timeout > 0) {
-                    lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, auth_timeout);
+                // Use the shorter of the two timeouts
+                int effective_timeout = (pss->idle_timeout_sec > 0 && pss->idle_timeout_sec < auth_timeout)
+                                        ? pss->idle_timeout_sec
+                                        : auth_timeout;
+                if (effective_timeout > 0) {
+                    lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, effective_timeout);
                     DEBUG_TRACE("Auth timeout set: %d seconds for unauthenticated connection from %s",
-                                auth_timeout, pss->client_ip);
+                                effective_timeout, pss->client_ip);
                 }
             }
 
@@ -664,6 +778,14 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                 const char* msg_type = cJSON_GetStringValue(type);
 
                                 if (strcmp(msg_type, "EVENT") == 0) {
+                                    // Mark session as active - client sent EVENT
+                                    pthread_mutex_lock(&pss->session_lock);
+                                    pss->session_active = 1;
+                                    pthread_mutex_unlock(&pss->session_lock);
+
+                                    // Cancel idle timeout - this is legitimate usage
+                                    lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+
                                     // Handle EVENT message
                                     cJSON* event = cJSON_GetArrayItem(json, 1);
                                     if (event && cJSON_IsObject(event)) {
@@ -1069,7 +1191,15 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                             return 0;
                                         }
                                     }
-    
+
+                                    // Mark session as active - client sent REQ
+                                    pthread_mutex_lock(&pss->session_lock);
+                                    pss->session_active = 1;
+                                    pthread_mutex_unlock(&pss->session_lock);
+
+                                    // Cancel idle timeout - this is legitimate usage
+                                    lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+
                                     DEBUG_TRACE("REQ message passed authentication check");
 
                                     // Handle REQ message
@@ -1367,6 +1497,14 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                             const char* msg_type = cJSON_GetStringValue(type);
 
                             if (strcmp(msg_type, "EVENT") == 0) {
+                                // Mark session as active - client sent EVENT
+                                pthread_mutex_lock(&pss->session_lock);
+                                pss->session_active = 1;
+                                pthread_mutex_unlock(&pss->session_lock);
+
+                                // Cancel idle timeout - this is legitimate usage
+                                lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+
                                 // Extract event for kind-specific NIP-42 authentication check
                                 cJSON* event_obj = cJSON_GetArrayItem(json, 1);
                                 if (event_obj && cJSON_IsObject(event_obj)) {
@@ -1834,9 +1972,17 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                             cJSON* sub_id = cJSON_GetArrayItem(json, 1);
 
                             if (sub_id && cJSON_IsString(sub_id)) {
-                                const char* subscription_id = cJSON_GetStringValue(sub_id);
+                            const char* subscription_id = cJSON_GetStringValue(sub_id);
 
-                                DEBUG_TRACE("Processing REQ message for subscription %s", subscription_id);
+                            // Mark session as active - client sent REQ
+                            pthread_mutex_lock(&pss->session_lock);
+                            pss->session_active = 1;
+                            pthread_mutex_unlock(&pss->session_lock);
+
+                            // Cancel idle timeout - this is legitimate usage
+                            lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
+
+                            DEBUG_TRACE("Processing REQ message for subscription %s", subscription_id);
 
                                 // Validate subscription ID before processing
                                 if (!subscription_id) {
@@ -2101,7 +2247,10 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
 
         case LWS_CALLBACK_CLOSED:
             DEBUG_TRACE("WebSocket connection closed");
-            
+
+            // Remove from global connection list (must happen before pss cleanup)
+            connection_list_remove(wsi);
+
             // Enhanced closure logging with detailed diagnostics
             if (pss) {
                 // Calculate connection duration
@@ -2115,12 +2264,23 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                     reason = "server_shutdown";
                 }
 
-                // Record auth failure if connection closed while unauthenticated and auth was required.
-                // This covers both the lws_set_timeout path (idle bots) and the reactive REQ path.
-                if (!pss->authenticated &&
-                    (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) &&
-                    pss->auth_challenge_sent &&
-                    strlen(pss->client_ip) > 0) {
+                // Record failure if connection closed without ever becoming active
+                // This catches:
+                // 1. Idle connections that timed out (never sent REQ/EVENT/AUTH)
+                // 2. Early disconnects (client closed before sending REQ/EVENT/AUTH)
+                // Only record for WebSocket connections, not HTTP requests (NIP-11, embedded files)
+                if (!pss->session_active && pss->is_websocket && strlen(pss->client_ip) > 0) {
+                    // Use separate idle failure recording (has its own threshold/duration)
+                    ip_ban_record_idle_failure(pss->client_ip);
+                    DEBUG_LOG("Recording idle/early-disconnect failure for IP %s (connected %ld seconds)",
+                              pss->client_ip,
+                              time(NULL) - pss->connection_established);
+                }
+                // Legacy: record auth failure if auth was required but not completed
+                else if (!pss->authenticated &&
+                         (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) &&
+                         pss->auth_challenge_sent &&
+                         strlen(pss->client_ip) > 0) {
                     ip_ban_record_failure(pss->client_ip);
                 }
                 
@@ -2290,9 +2450,10 @@ static void check_connection_age(int max_connection_seconds) {
     // Cleanup
     free(checked_wsis);
 
-    // Periodic IP ban maintenance: cleanup expired entries and log stats
+    // Periodic IP ban maintenance: cleanup expired entries, log stats, save to DB
     ip_ban_cleanup();
-    ip_ban_log_stats();
+    extern sqlite3* g_db;
+    ip_ban_log_stats(g_db);
 }
 
 // WebSocket protocol definition
@@ -2451,6 +2612,9 @@ int start_websocket_relay(int port_override, int strict_port) {
         return -1;
     }
 
+    // Persist the actual bound port for components that need the runtime relay URL
+    g_relay_port = actual_port;
+
     char startup_msg[256];
     if (actual_port != configured_port) {
         snprintf(startup_msg, sizeof(startup_msg),
@@ -2493,12 +2657,25 @@ int start_websocket_relay(int port_override, int strict_port) {
         int max_connection_seconds = get_config_int("max_connection_seconds", 86400);
         if (current_time - last_connection_age_check >= 60) {
             last_connection_age_check = current_time;
+
+            // Live debug level update: read from config table so it can be changed
+            // without restarting the relay (via config_set admin command or direct SQL)
+            int config_debug_level = get_config_int("debug_level", -1);
+            if (config_debug_level >= 0 && config_debug_level != g_debug_level) {
+                DEBUG_WARN("Debug level changed: %d -> %d", g_debug_level, config_debug_level);
+                g_debug_level = config_debug_level;
+            }
+            // Check and close idle connections (no REQ/EVENT sent within timeout)
+            int idle_timeout_sec = get_config_int("idle_connection_timeout_sec", 30);
+            check_idle_connections(idle_timeout_sec);
+
             if (max_connection_seconds > 0) {
                 check_connection_age(max_connection_seconds);
             } else {
                 // Even when connection age limit is disabled, run IP ban maintenance
                 ip_ban_cleanup();
-                ip_ban_log_stats();
+                extern sqlite3* g_db;
+                ip_ban_log_stats(g_db);
             }
         }
     }

src/websockets.h

@@ -89,8 +89,19 @@ struct per_session_data {
     int db_queries_executed;                  // Total SELECT queries executed by this connection
     int db_rows_returned;                     // Total rows returned across all queries
     time_t query_tracking_start;              // When connection was established (for rate calculation)
+
+    // Session activity tracking for idle connection banning
+    int session_active;                       // 1 if client sent REQ or EVENT, 0 otherwise
+    int idle_timeout_sec;                     // Timeout value for this session (copied from config)
+    int is_websocket;                         // 1 if this is a WebSocket connection, 0 for HTTP
 };
 
+// Get current active WebSocket connection count
+int get_active_connection_count(void);
+
+// Actual relay port bound by libwebsockets at runtime (after fallback/retry logic)
+extern int g_relay_port;
+
 // NIP-11 HTTP session data structure for managing buffer lifetime
 struct nip11_session_data {
     int type; // 0 for NIP-11

tests/kind4_disconnect_probe.mjs

@@ -0,0 +1,272 @@
+#!/usr/bin/env node
+
+import WebSocket from 'ws';
+import {
+  finalizeEvent,
+  generateSecretKey,
+  getPublicKey,
+  nip19,
+  nip42,
+} from 'nostr-tools';
+
+const RELAY_URL = process.env.RELAY_URL || 'ws://127.0.0.1:7777';
+const EVENT_COUNT = Number(process.env.EVENT_COUNT || 5);
+const DELAY_MS = Number(process.env.DELAY_MS || 2000);
+const RECIPIENT_PUBKEY_ENV = process.env.RECIPIENT_PUBKEY || '';
+const SECRET_INPUT = process.env.NOSTR_SECRET_KEY || '';
+const OVERALL_TIMEOUT_MS = Number(process.env.OVERALL_TIMEOUT_MS || 120000);
+
+function now() {
+  return new Date().toISOString();
+}
+
+function log(msg, extra = null) {
+  if (extra !== null) {
+    console.log(`[${now()}] ${msg}`, extra);
+  } else {
+    console.log(`[${now()}] ${msg}`);
+  }
+}
+
+function normalizeHexSecret(secretInput) {
+  if (!secretInput) return null;
+
+  const raw = secretInput.trim();
+  if (/^[0-9a-fA-F]{64}$/.test(raw)) {
+    return raw.toLowerCase();
+  }
+
+  if (raw.startsWith('nsec1')) {
+    const decoded = nip19.decode(raw);
+    if (decoded.type !== 'nsec') {
+      throw new Error('NOSTR_SECRET_KEY is nsec-like but did not decode as nsec');
+    }
+    if (typeof decoded.data === 'string') {
+      return decoded.data.toLowerCase();
+    }
+    if (decoded.data instanceof Uint8Array) {
+      return Buffer.from(decoded.data).toString('hex').toLowerCase();
+    }
+    throw new Error('Unsupported nsec decoded payload type');
+  }
+
+  throw new Error('NOSTR_SECRET_KEY must be 64-char hex or nsec1...');
+}
+
+const hexSecret = normalizeHexSecret(SECRET_INPUT) || Buffer.from(generateSecretKey()).toString('hex');
+const secretKey = Buffer.from(hexSecret, 'hex');
+const senderPubkey = getPublicKey(secretKey);
+const recipientPubkey = RECIPIENT_PUBKEY_ENV || senderPubkey;
+
+let ws;
+let currentChallenge = null;
+let authenticated = false;
+let authAttempts = 0;
+let sentAccepted = 0;
+let nextSeq = 1;
+let pendingEvent = null;
+let waitingForAuth = false;
+let finished = false;
+let overallTimer = null;
+
+function makeKind4Event(seq) {
+  const eventTemplate = {
+    kind: 4,
+    created_at: Math.floor(Date.now() / 1000),
+    tags: [['p', recipientPubkey]],
+    content: `kind4 disconnect probe seq=${seq} ts=${Date.now()}`,
+    pubkey: senderPubkey,
+  };
+  return finalizeEvent(eventTemplate, secretKey);
+}
+
+function sendJson(arr) {
+  const payload = JSON.stringify(arr);
+  ws.send(payload);
+}
+
+function sendAuth(challenge) {
+  const authTemplate = nip42.makeAuthEvent(RELAY_URL, challenge);
+  const signedAuth = finalizeEvent(authTemplate, secretKey);
+  authAttempts += 1;
+  log(`Sending AUTH attempt #${authAttempts} with challenge ${challenge}`);
+  sendJson(['AUTH', signedAuth]);
+}
+
+function scheduleNext() {
+  if (nextSeq > EVENT_COUNT) {
+    log(`All ${EVENT_COUNT} kind-4 events were accepted without disconnect`);
+    cleanupAndExit(0);
+    return;
+  }
+  setTimeout(() => {
+    if (!finished) {
+      publishNext();
+    }
+  }, DELAY_MS);
+}
+
+function publishNext() {
+  if (waitingForAuth) {
+    log('Still waiting for auth completion, postponing publish');
+    return;
+  }
+
+  const ev = makeKind4Event(nextSeq);
+  pendingEvent = ev;
+  log(`Publishing kind-4 seq=${nextSeq} id=${ev.id.slice(0, 12)}...`);
+  sendJson(['EVENT', ev]);
+}
+
+function retryPendingAfterAuth() {
+  if (!pendingEvent) return;
+  waitingForAuth = false;
+  log(`Retrying pending kind-4 id=${pendingEvent.id.slice(0, 12)}... after auth`);
+  sendJson(['EVENT', pendingEvent]);
+}
+
+function handleAuthRequiredSignal(source, msg) {
+  waitingForAuth = true;
+  log(`Relay signaled auth-required via ${source}: ${msg}`);
+  if (currentChallenge) {
+    sendAuth(currentChallenge);
+  } else {
+    log('No AUTH challenge received yet; waiting for relay AUTH challenge message');
+  }
+}
+
+function cleanupAndExit(code) {
+  if (finished) return;
+  finished = true;
+  if (overallTimer) clearTimeout(overallTimer);
+
+  const summary = {
+    relay: RELAY_URL,
+    sentAccepted,
+    expected: EVENT_COUNT,
+    authAttempts,
+    authenticated,
+    senderPubkey,
+    recipientPubkey,
+  };
+
+  if (code === 0) {
+    log('PASS: Connection remained stable through repeated kind-4 publish cycle', summary);
+  } else {
+    log('FAIL: Relay disconnected or test did not complete successfully', summary);
+  }
+
+  try {
+    if (ws && ws.readyState === WebSocket.OPEN) {
+      ws.close();
+    }
+  } catch (_) {}
+
+  process.exit(code);
+}
+
+function main() {
+  log('Starting kind-4 disconnect probe', {
+    relay: RELAY_URL,
+    eventCount: EVENT_COUNT,
+    delayMs: DELAY_MS,
+    senderPubkey,
+    recipientPubkey,
+  });
+
+  ws = new WebSocket(RELAY_URL);
+
+  overallTimer = setTimeout(() => {
+    log(`Overall timeout reached (${OVERALL_TIMEOUT_MS}ms)`);
+    cleanupAndExit(1);
+  }, OVERALL_TIMEOUT_MS);
+
+  ws.on('open', () => {
+    log('WebSocket connected');
+    publishNext();
+  });
+
+  ws.on('message', (raw) => {
+    const text = raw.toString();
+    let msg;
+    try {
+      msg = JSON.parse(text);
+    } catch {
+      log(`Non-JSON relay message: ${text}`);
+      return;
+    }
+
+    const t = msg?.[0];
+
+    if (t === 'AUTH') {
+      currentChallenge = msg?.[1] || null;
+      log(`Received AUTH challenge: ${currentChallenge}`);
+      if (currentChallenge) sendAuth(currentChallenge);
+      return;
+    }
+
+    if (t === 'NOTICE') {
+      const notice = String(msg?.[1] || '');
+      log(`NOTICE: ${notice}`);
+
+      if (notice.toLowerCase().includes('auth-required')) {
+        handleAuthRequiredSignal('NOTICE', notice);
+        return;
+      }
+
+      if (notice.toLowerCase().includes('authentication successful')) {
+        authenticated = true;
+        log('Relay confirmed NIP-42 authentication success');
+        retryPendingAfterAuth();
+      }
+      return;
+    }
+
+    if (t === 'OK') {
+      const eventId = msg?.[1];
+      const ok = !!msg?.[2];
+      const reason = String(msg?.[3] || '');
+      log(`OK for ${String(eventId).slice(0, 12)}... accepted=${ok} reason=${reason}`);
+
+      if (!ok && reason.toLowerCase().includes('auth-required')) {
+        handleAuthRequiredSignal('OK', reason);
+        return;
+      }
+
+      if (pendingEvent && eventId === pendingEvent.id) {
+        if (ok) {
+          sentAccepted += 1;
+          nextSeq += 1;
+          pendingEvent = null;
+          waitingForAuth = false;
+          scheduleNext();
+        } else {
+          log(`Pending event rejected: ${reason}`);
+          cleanupAndExit(1);
+        }
+      }
+      return;
+    }
+
+    log('Relay message', msg);
+  });
+
+  ws.on('close', (code, reasonBuf) => {
+    const reason = reasonBuf?.toString?.() || '';
+    log(`WebSocket closed code=${code} reason=${reason}`);
+    if (!finished) {
+      if (sentAccepted >= EVENT_COUNT) {
+        cleanupAndExit(0);
+      } else {
+        cleanupAndExit(1);
+      }
+    }
+  });
+
+  ws.on('error', (err) => {
+    log(`WebSocket error: ${err.message}`);
+    cleanupAndExit(1);
+  });
+}
+
+main();

tests/nip42_test.log

@@ -0,0 +1,88 @@
+=== NIP-42 Authentication Test Started ===
+2026-02-24 09:45:30 - Starting NIP-42 authentication tests
+[INFO] === Starting NIP-42 Authentication Tests ===
+[INFO] Checking dependencies...
+[SUCCESS] Dependencies check complete
+[INFO] Test 1: Checking NIP-42 support in relay info
+[SUCCESS] NIP-42 is advertised in supported NIPs
+2026-02-24 09:45:30 - Supported NIPs: 1,2,4,9,11,12,13,15,16,20,22,33,40,42,50,70
+[INFO] Test 2: Testing AUTH challenge generation
+[WARNING] Could not extract admin private key from relay.log - using manual test approach
+[INFO] Manual test: Connect to relay and send an event without auth to trigger challenge
+[INFO] Test 3: Testing complete NIP-42 authentication flow
+[INFO] Generated test keypair: test_pubkey
+[INFO] Attempting to publish event without authentication...
+[INFO] Publishing test event to relay...
+2026-02-24 09:45:31 - Event publish result: connecting to ws://localhost:8888... ok.
+{"kind":1,"id":"74a0b723797569b2483d47457d2f6e2378aed6ccd4cca0f553038e0431ade0e8","pubkey":"7a2f213c220c46a194c5730e5bb2fe9b27304f0c27226f380086d93ff10bf7da","created_at":1771940731,"tags":[],"content":"NIP-42 test event - should require auth","sig":"319466df2167cd7f33c83d41b09bdd06f23c961380fd205a0a5dc5a923f11e45b6d158d79e251239bef364430c5d45e6a9e43fe93fd629864a88de00e6766a44"}
+publishing to ws://localhost:8888... success.
+[SUCCESS] Relay requested authentication as expected
+[INFO] Test 4: Testing WebSocket AUTH message handling
+[INFO] Testing WebSocket connection and AUTH message...
+[INFO] Sending test message via WebSocket...
+2026-02-24 09:45:31 - WebSocket response: 
+[INFO] No AUTH challenge in WebSocket response
+[INFO] Test 5: Testing NIP-42 configuration options
+[INFO] Retrieving current relay configuration...
+[WARNING] Could not retrieve configuration events
+[INFO] Test 6: Testing NIP-42 performance and stability
+[INFO] Testing multiple authentication attempts...
+2026-02-24 09:45:33 - Attempt 1: .264126491s - connecting to ws://localhost:8888... ok.
+{"kind":1,"id":"9cb8f626ced97e8fc406bd2d2358074fe33542d983d11a7f039a26919ded6039","pubkey":"7c098dbaeeaca6fb27798625835dfc5c13fb31096eed76c6d77269a2a08cd22b","created_at":1771940733,"tags":[],"content":"Performance test event 1","sig":"87025c881004a7936589785bbba6171542135348e4f798c490c033eb462c9a0322882cfe1a2b742e3644b6c69ee4fee76feb3cffecd6d64c096fa8038bcd84c4"}
+publishing to ws://localhost:8888... success.
+2026-02-24 09:45:33 - Attempt 2: .262980094s - connecting to ws://localhost:8888... ok.
+{"kind":1,"id":"bb1b3da4cccbcdc6be73646e29ecf060b68d8cb9340f8b23da0f167ffac0831d","pubkey":"7c098dbaeeaca6fb27798625835dfc5c13fb31096eed76c6d77269a2a08cd22b","created_at":1771940733,"tags":[],"content":"Performance test event 2","sig":"1349f7af97edb9f507081782cfb2d055eb810ec96056b97692920060091ccf39b8d1ba8590d25e1b3c92f4b785f6362ac0d734373d29d4159e5778f8982b086f"}
+publishing to ws://localhost:8888... success.
+2026-02-24 09:45:34 - Attempt 3: .296311100s - connecting to ws://localhost:8888... ok.
+{"kind":1,"id":"3b171de7c00e918ad0bcbedea4c07c69f59a9d20c31b0de957488c919fa5c116","pubkey":"7c098dbaeeaca6fb27798625835dfc5c13fb31096eed76c6d77269a2a08cd22b","created_at":1771940734,"tags":[],"content":"Performance test event 3","sig":"a1699f12064d4da7ba15519eb7666cd2801f333ee837df70ce1298ac97477e900d095dce8fed0bade8f3e3e2e2b68e22800d10ba213a1de6cd1537112d6a6c2a"}
+publishing to ws://localhost:8888... success.
+2026-02-24 09:45:35 - Attempt 4: .300140904s - connecting to ws://localhost:8888... ok.
+{"kind":1,"id":"f3587b9955204284ec65f2b171d1fa3f330e0bbfc2d95fe7ad0550a63a6aabe6","pubkey":"7c098dbaeeaca6fb27798625835dfc5c13fb31096eed76c6d77269a2a08cd22b","created_at":1771940734,"tags":[],"content":"Performance test event 4","sig":"fb78cd3bce49097eea1c67c0a1ee92bf4cdf5bf6396ce20519481d0e4d09b03dca05c70da2ddf5ba51d23aa3253b21ec3b57bc41d000f274bb1123a4c3d64c45"}
+publishing to ws://localhost:8888... success.
+2026-02-24 09:45:35 - Attempt 5: .373738147s - connecting to ws://localhost:8888... ok.
+{"kind":1,"id":"e1fdf2d0579f0e2b446bdd9dbe5f5e53913b7d328d6f527ac7142636979c1ff2","pubkey":"7c098dbaeeaca6fb27798625835dfc5c13fb31096eed76c6d77269a2a08cd22b","created_at":1771940735,"tags":[],"content":"Performance test event 5","sig":"a11a11991434511737092d8cf2806a700a207c81c08e341f8d98c8b3369845df35adb9247ff094378e6712d68e5b2657d628e809b17bc9f838f6f5d9c21ce96c"}
+publishing to ws://localhost:8888... success.
+[SUCCESS] Performance test completed: 5/5 successful responses
+[INFO] Test 7: Testing kind-specific NIP-42 authentication requirements
+[INFO] Generated test keypair for kind-specific tests: test_pubkey
+[INFO] Testing kind 1 event (regular note) - should work without authentication...
+2026-02-24 09:45:36 - Kind 1 event result: connecting to ws://localhost:8888... ok.
+{"kind":1,"id":"85430aa1bb17e0aa7f5f05568448e35570a0d8446a79600f033e2683b17f8902","pubkey":"1cee941c80f1fa0037047151cf577503a1243cbef748f572b9fd6062a36807db","created_at":1771940736,"tags":[],"content":"Regular note - should not require auth","sig":"118a2dec1256aca39b22b9027c8f56e0b8f60bae1d95f38408ac9d9a6eb6590c48e4a37bf561e29f993b435ceecc1ff2218fcc9dec3e2dcf305cd456ac6a0ee4"}
+publishing to ws://localhost:8888... success.
+[SUCCESS] Kind 1 event accepted without authentication (correct behavior)
+[INFO] Testing kind 4 event (direct message) - should require authentication...
+2026-02-24 09:45:47 - Kind 4 event result: connecting to ws://localhost:8888... ok.
+{"kind":4,"id":"32f20767dd83d6f1ee5e70f72c33c7caa8a5a03acbfbb4de5899f6b27b850be4","pubkey":"1cee941c80f1fa0037047151cf577503a1243cbef748f572b9fd6062a36807db","created_at":1771940737,"tags":[["p,test_pubkey"]],"content":"This is a direct message - should require auth","sig":"cee96adf8c266120d98579734134cca652eeefa5f090d119b794a964bae4d2568e3aa39d648e5a897bb7f8d65be19f338291af3ffe87accdbf502f5eaae453ab"}
+publishing to ws://localhost:8888... 
+[SUCCESS] Kind 4 event requested authentication (correct behavior for DMs)
+[INFO] Testing kind 14 event (chat message) - should require authentication...
+2026-02-24 09:45:57 - Kind 14 event result: connecting to ws://localhost:8888... ok.
+{"kind":14,"id":"0a6d37f32fc10dae793b61d8f3afb9d28bdf12d59cf25d73eb90461d8efaa117","pubkey":"1cee941c80f1fa0037047151cf577503a1243cbef748f572b9fd6062a36807db","created_at":1771940747,"tags":[["p,test_pubkey"]],"content":"Chat message - should require auth","sig":"5337ded22499a8c361445d6c660f297e636cc5adf2735a85bb7d629e5771e0c47176b2afde02f4af9645198d441fb0aedd78931d0200d8b5ed8f721e6460d5c9"}
+publishing to ws://localhost:8888... 
+[SUCCESS] Kind 14 event requested authentication (correct behavior for DMs)
+[INFO] Testing other event kinds - should work without authentication...
+2026-02-24 09:45:58 - Kind 0 event result: connecting to ws://localhost:8888... ok.
+{"kind":0,"id":"5836e2da48eb458c8faca084afc3827ee6e481574d0295dc7bfdc50d9495891a","pubkey":"1cee941c80f1fa0037047151cf577503a1243cbef748f572b9fd6062a36807db","created_at":1771940757,"tags":[],"content":"Test event kind 0 - should not require auth","sig":"e454d5990a157b6211b655a9219ad494c58d49a59d61c4e1fb0aa91b96e5ff2368efc57e2acd0a24c7198b1181c37d0ab535f608289ec83afdc0b68e076def7c"}
+publishing to ws://localhost:8888... success.
+[SUCCESS] Kind 0 event accepted without authentication (correct)
+2026-02-24 09:45:58 - Kind 3 event result: connecting to ws://localhost:8888... ok.
+{"kind":3,"id":"d11a038044f9ea859338c6ab879c4628aece258f2cad0ed7ca88808b35ec899c","pubkey":"1cee941c80f1fa0037047151cf577503a1243cbef748f572b9fd6062a36807db","created_at":1771940758,"tags":[],"content":"Test event kind 3 - should not require auth","sig":"9fbf410cd609f9f7a6bf3118ecfe554776bb647d5ed988c0d4df06f83c1283c8baeaa0b62da900934cc8f617c73572fbce9f7232c77bb87942e4471228b06c73"}
+publishing to ws://localhost:8888... success.
+[SUCCESS] Kind 3 event accepted without authentication (correct)
+2026-02-24 09:45:59 - Kind 7 event result: connecting to ws://localhost:8888... ok.
+{"kind":7,"id":"b819482f287f6370fac7804c2cdcdac8340eafd86799b24af0a11f74c6190fed","pubkey":"1cee941c80f1fa0037047151cf577503a1243cbef748f572b9fd6062a36807db","created_at":1771940758,"tags":[],"content":"Test event kind 7 - should not require auth","sig":"f197c7c072af111dd92220c489472473f5b4fb30e908501e4d2d0037f1a0064960550a4e51af4168572a192295d870f6a6c49473308a25dacbc0deb703003547"}
+publishing to ws://localhost:8888... success.
+[SUCCESS] Kind 7 event accepted without authentication (correct)
+[INFO] Kind-specific authentication test completed
+[INFO] === NIP-42 Test Results Summary ===
+[SUCCESS] Dependencies: PASS
+[SUCCESS] NIP-42 Support: PASS
+[SUCCESS] Auth Challenge: PASS
+[SUCCESS] Auth Flow: PASS
+[SUCCESS] WebSocket AUTH: PASS
+[SUCCESS] Configuration: PASS
+[SUCCESS] Performance: PASS
+[SUCCESS] Kind-Specific Auth: PASS
+[SUCCESS] All NIP-42 tests completed successfully!
+[SUCCESS] NIP-42 authentication implementation is working correctly
+[INFO] === NIP-42 Authentication Tests Complete ===