@dev-anywhere/relay 0.4.73 → 0.4.74

package/dist/{chunk-UV7DNQUI.js → chunk-XY4ATTV2.js}

@@ -562,7 +562,8 @@ var RequestErrorShape = {
   error: z8.string().optional(),
   errorCode: ControlErrorCodeSchema.optional()
 };
-var ClipboardImageMimeTypeSchema = z8.enum(["image/png", "image/jpeg", "image/webp", "image/gif"]);
+var RemoteFileDispositionSchema = z8.enum(["inline", "download"]);
+var RemoteFileUploadKindSchema = z8.enum(["clipboard_image", "file"]);
 function control(type, shape, directions) {
   return {
     type,
@@ -601,6 +602,82 @@ var relayControlDefinitions = [
   control("relay_client_kicked", {
     reason: z8.string().optional()
   }),
+  control("remote_file_url_request", {
+    ...RequiredRequestIdShape,
+    sessionId: IdSchema,
+    path: z8.string().min(1),
+    disposition: RemoteFileDispositionSchema
+  }),
+  control("remote_file_url_response", {
+    ...RequiredRequestIdShape,
+    ...RequestErrorShape,
+    sessionId: IdSchema,
+    path: z8.string().optional(),
+    success: z8.boolean(),
+    url: z8.string().optional(),
+    expiresAt: z8.number().int().nonnegative().optional()
+  }),
+  control("remote_file_stream_request", {
+    streamId: IdSchema,
+    sessionId: IdSchema,
+    path: z8.string().min(1),
+    disposition: RemoteFileDispositionSchema
+  }),
+  control("remote_file_stream_response", {
+    ...RequestErrorShape,
+    streamId: IdSchema,
+    sessionId: IdSchema,
+    success: z8.boolean(),
+    path: z8.string().optional(),
+    mimeType: z8.string().optional(),
+    size: z8.number().int().nonnegative().optional(),
+    fileName: z8.string().optional()
+  }),
+  control("remote_file_stream_complete", {
+    ...RequestErrorShape,
+    streamId: IdSchema,
+    success: z8.boolean()
+  }),
+  control("remote_file_stream_cancel", {
+    streamId: IdSchema
+  }),
+  control("remote_file_upload_url_request", {
+    ...RequiredRequestIdShape,
+    sessionId: IdSchema,
+    kind: RemoteFileUploadKindSchema,
+    fileName: z8.string().optional(),
+    mimeType: z8.string().min(1),
+    size: z8.number().int().nonnegative().optional()
+  }),
+  control("remote_file_upload_url_response", {
+    ...RequiredRequestIdShape,
+    ...RequestErrorShape,
+    sessionId: IdSchema,
+    success: z8.boolean(),
+    uploadUrl: z8.string().optional(),
+    expiresAt: z8.number().int().nonnegative().optional()
+  }),
+  control("remote_file_upload_stream_request", {
+    uploadId: IdSchema,
+    sessionId: IdSchema,
+    kind: RemoteFileUploadKindSchema,
+    fileName: z8.string().optional(),
+    mimeType: z8.string().min(1),
+    size: z8.number().int().nonnegative().optional()
+  }),
+  control("remote_file_upload_stream_complete", {
+    uploadId: IdSchema
+  }),
+  control("remote_file_upload_stream_cancel", {
+    uploadId: IdSchema
+  }),
+  control("remote_file_upload_stream_response", {
+    ...RequestErrorShape,
+    uploadId: IdSchema,
+    sessionId: IdSchema,
+    success: z8.boolean(),
+    path: z8.string().optional()
+  }),
   control("proxy_select", { ...RequestIdShape, proxyId: IdSchema }),
   control("proxy_select_response", {
     ...RequestIdShape,
@@ -768,70 +845,6 @@ var relayControlDefinitions = [
   }, "proxy_to_client"),
   // 客户端发送到 PTY 的原始字节（ANSI 序列），不追加换行
   control("remote_input_raw", { sessionId: IdSchema, data: z8.string(), traceId: IdSchema.optional() }, "client_to_proxy"),
-  control("clipboard_image_upload", {
-    ...RequestIdShape,
-    sessionId: IdSchema,
-    mimeType: ClipboardImageMimeTypeSchema,
-    dataBase64: z8.string().min(1),
-    fileName: z8.string().optional()
-  }, "client_to_proxy"),
-  control("clipboard_image_upload_response", {
-    ...RequestIdShape,
-    ...RequestErrorShape,
-    sessionId: IdSchema,
-    success: z8.boolean(),
-    // success=false 时 proxy 没有有效 path 可填；保持 optional 以避免占位空字符串通过校验。
-    path: z8.string().optional()
-  }, "proxy_to_client"),
-  control("image_preview_request", {
-    ...RequestIdShape,
-    sessionId: IdSchema,
-    path: z8.string().min(1)
-  }, "client_to_proxy"),
-  control("image_preview_response", {
-    ...RequestIdShape,
-    ...RequestErrorShape,
-    sessionId: IdSchema,
-    success: z8.boolean(),
-    // 同 clipboard_image_upload_response：失败时 proxy 不一定有路径。
-    path: z8.string().optional(),
-    mimeType: ClipboardImageMimeTypeSchema.optional(),
-    dataBase64: z8.string().optional(),
-    size: z8.number().int().nonnegative().optional()
-  }, "proxy_to_client"),
-  // 任意文件下载: 与 image_preview 形状对称, 只是 mimeType 不限定为图片;
-  // 单租户场景下 path 任意 (不受 previewRoots 限制), 由 proxy 端 size cap 兜底。
-  control("file_download_request", {
-    ...RequestIdShape,
-    sessionId: IdSchema,
-    path: z8.string().min(1)
-  }, "client_to_proxy"),
-  control("file_download_response", {
-    ...RequestIdShape,
-    ...RequestErrorShape,
-    sessionId: IdSchema,
-    success: z8.boolean(),
-    path: z8.string().optional(),
-    mimeType: z8.string().optional(),
-    dataBase64: z8.string().optional(),
-    size: z8.number().int().nonnegative().optional()
-  }, "proxy_to_client"),
-  // 任意文件上传: 复用 clipboard_image_upload 的形状, mimeType 放开 + fileName 必填,
-  // 由 proxy 端写入 session cwd 的 .dev-anywhere/uploads/ 子目录, 返回相对路径供 web 拼成 @path。
-  control("file_upload_request", {
-    ...RequestIdShape,
-    sessionId: IdSchema,
-    mimeType: z8.string().min(1),
-    dataBase64: z8.string().min(1),
-    fileName: z8.string().min(1)
-  }, "client_to_proxy"),
-  control("file_upload_response", {
-    ...RequestIdShape,
-    ...RequestErrorShape,
-    sessionId: IdSchema,
-    success: z8.boolean(),
-    path: z8.string().optional()
-  }, "proxy_to_client"),
   // 客户端询问 proxy 的环境信息 (home 路径等), client -> proxy -> response
   // FilePathPicker 用 homePath 作为 select 模式下的默认起点, 新建会话时打开即可浏览
   control("proxy_info_request", RequestIdShape, "client_to_proxy"),
@@ -983,6 +996,42 @@ var RelayCloseCode = {
 var SID_LEN_BYTES = 1;
 var SEQ_BYTES = 4;
 var HEADER_FIXED_BYTES = SID_LEN_BYTES + SEQ_BYTES;
+var FILE_STREAM_MARKER = 0;
+var FILE_STREAM_ID_LEN_BYTES = 1;
+var FILE_STREAM_HEADER_FIXED_BYTES = 1 + FILE_STREAM_ID_LEN_BYTES + SEQ_BYTES;
+function encodeFileStreamFrame(streamId, chunkSeq, data) {
+  const streamIdBytes = new TextEncoder().encode(streamId);
+  if (streamIdBytes.length === 0 || streamIdBytes.length > 255) {
+    throw new RangeError(`streamId byte length must be 1-255, got ${streamIdBytes.length} (streamId=${streamId})`);
+  }
+  if (!Number.isInteger(chunkSeq) || chunkSeq < 0 || chunkSeq > 4294967295) {
+    throw new RangeError(`chunkSeq must be a uint32, got ${chunkSeq}`);
+  }
+  const frame = new Uint8Array(1 + FILE_STREAM_ID_LEN_BYTES + streamIdBytes.length + SEQ_BYTES + data.length);
+  frame[0] = FILE_STREAM_MARKER;
+  frame[1] = streamIdBytes.length;
+  frame.set(streamIdBytes, 1 + FILE_STREAM_ID_LEN_BYTES);
+  const seqOffset = 1 + FILE_STREAM_ID_LEN_BYTES + streamIdBytes.length;
+  new DataView(frame.buffer, frame.byteOffset + seqOffset, SEQ_BYTES).setUint32(0, chunkSeq, true);
+  frame.set(data, seqOffset + SEQ_BYTES);
+  return frame;
+}
+function decodeFileStreamFrame(view) {
+  if (view.length < FILE_STREAM_HEADER_FIXED_BYTES)
+    return null;
+  if (view[0] !== FILE_STREAM_MARKER)
+    return null;
+  const streamIdLen = view[1];
+  if (streamIdLen === 0)
+    return null;
+  if (view.length < 1 + FILE_STREAM_ID_LEN_BYTES + streamIdLen + SEQ_BYTES)
+    return null;
+  const streamId = new TextDecoder().decode(view.subarray(1 + FILE_STREAM_ID_LEN_BYTES, 1 + FILE_STREAM_ID_LEN_BYTES + streamIdLen));
+  const seqOffset = 1 + FILE_STREAM_ID_LEN_BYTES + streamIdLen;
+  const chunkSeq = new DataView(view.buffer, view.byteOffset + seqOffset, SEQ_BYTES).getUint32(0, true);
+  const data = view.subarray(seqOffset + SEQ_BYTES);
+  return { streamId, chunkSeq, data };
+}
 
 // ../../packages/shared/dist/state-machine.js
 function computeAbsorbingSet(transitions) {
@@ -1612,7 +1661,7 @@ function rejectNotRegistered(ws) {
     })
   );
 }
-function handleProxyConnection(ws, registry, logger, chaos) {
+function handleProxyConnection(ws, registry, logger, chaos, remoteFileBridge) {
   const proxyWs = ws;
   proxyWs.isAlive = true;
   proxyWs.on("pong", () => {
@@ -1624,6 +1673,9 @@ function handleProxyConnection(ws, registry, logger, chaos) {
         logger.warn({ size: data.length }, "Binary frame rejected: invalid size");
         return;
       }
+      if (proxyWs.proxyId && remoteFileBridge?.handleProxyBinary(proxyWs.proxyId, data)) {
+        return;
+      }
       const sessionIdLen = data[0];
       if (sessionIdLen === 0 || sessionIdLen > 255 || data.length < 1 + sessionIdLen) {
         logger.warn(
@@ -1712,6 +1764,18 @@ function handleProxyConnection(ws, registry, logger, chaos) {
       return;
     }
     if (result.kind === "control") {
+      if (proxyWs.proxyId && result.message.type === "remote_file_stream_response") {
+        remoteFileBridge?.handleProxyControl(proxyWs.proxyId, result.message);
+        return;
+      }
+      if (proxyWs.proxyId && result.message.type === "remote_file_stream_complete") {
+        remoteFileBridge?.handleProxyControl(proxyWs.proxyId, result.message);
+        return;
+      }
+      if (proxyWs.proxyId && result.message.type === "remote_file_upload_stream_response") {
+        remoteFileBridge?.handleProxyControl(proxyWs.proxyId, result.message);
+        return;
+      }
       if (isProxyToClientRelayControlType(result.message.type)) {
         if (!proxyWs.proxyId) {
           rejectNotRegistered(proxyWs);
@@ -2610,7 +2674,31 @@ function sendRelayProxyProbeFailure(ws, requestId, error, chaos) {
   }
   ws.send(response);
 }
-function handleClientConnection(ws, registry, logger, chaos, voiceConfigStore, voiceProviders, connectionInfo = {}) {
+function sendRemoteFileUrlFailure(ws, requestId, sessionId, error, errorCode = ControlErrorCode.UNKNOWN) {
+  ws.send(
+    serializeControl({
+      type: "remote_file_url_response",
+      requestId,
+      sessionId,
+      success: false,
+      error,
+      errorCode
+    })
+  );
+}
+function sendRemoteFileUploadUrlFailure(ws, requestId, sessionId, error, errorCode = ControlErrorCode.UNKNOWN) {
+  ws.send(
+    serializeControl({
+      type: "remote_file_upload_url_response",
+      requestId,
+      sessionId,
+      success: false,
+      error,
+      errorCode
+    })
+  );
+}
+function handleClientConnection(ws, registry, logger, chaos, voiceConfigStore, voiceProviders, remoteFileBridge, connectionInfo = {}) {
   const clientWs = ws;
   clientWs.isAlive = true;
   registry.addClientWs(clientWs, connectionInfo);
@@ -2648,6 +2736,115 @@ function handleClientConnection(ws, registry, logger, chaos, voiceConfigStore, v
         handleRelayClientKick(clientWs, registry, logger, msg.requestId, msg.clientId);
         return;
       }
+      if (msg.type === "remote_file_url_request") {
+        if (!remoteFileBridge) {
+          sendRemoteFileUrlFailure(clientWs, msg.requestId, msg.sessionId, "\u6587\u4EF6\u6D41\u670D\u52A1\u4E0D\u53EF\u7528");
+          return;
+        }
+        if (!clientWs.clientId) {
+          sendRemoteFileUrlFailure(
+            clientWs,
+            msg.requestId,
+            msg.sessionId,
+            "\u5BA2\u6237\u7AEF\u672A\u6CE8\u518C",
+            ControlErrorCode.UNKNOWN
+          );
+          return;
+        }
+        const targetProxyId = clientWs.boundProxyId;
+        if (!targetProxyId || !registry.isProxyOnline(targetProxyId)) {
+          sendRemoteFileUrlFailure(
+            clientWs,
+            msg.requestId,
+            msg.sessionId,
+            "\u5F53\u524D\u672A\u8FDE\u63A5\u5F00\u53D1\u673A",
+            ControlErrorCode.PROXY_OFFLINE
+          );
+          return;
+        }
+        const ownerProxyId = registry.getProxyForSession(msg.sessionId);
+        if (ownerProxyId && ownerProxyId !== targetProxyId) {
+          sendRemoteFileUrlFailure(
+            clientWs,
+            msg.requestId,
+            msg.sessionId,
+            "\u4F1A\u8BDD\u4E0D\u5C5E\u4E8E\u5F53\u524D\u5F00\u53D1\u673A",
+            ControlErrorCode.SESSION_NOT_FOUND
+          );
+          return;
+        }
+        const { url, expiresAt } = remoteFileBridge.createUrl({
+          clientId: clientWs.clientId,
+          proxyId: targetProxyId,
+          sessionId: msg.sessionId,
+          path: msg.path,
+          disposition: msg.disposition
+        });
+        clientWs.send(
+          serializeControl({
+            type: "remote_file_url_response",
+            requestId: msg.requestId,
+            sessionId: msg.sessionId,
+            path: msg.path,
+            success: true,
+            url,
+            expiresAt
+          })
+        );
+        return;
+      }
+      if (msg.type === "remote_file_upload_url_request") {
+        if (!remoteFileBridge) {
+          sendRemoteFileUploadUrlFailure(clientWs, msg.requestId, msg.sessionId, "\u4E0A\u4F20\u670D\u52A1\u4E0D\u53EF\u7528");
+          return;
+        }
+        if (!clientWs.clientId) {
+          sendRemoteFileUploadUrlFailure(clientWs, msg.requestId, msg.sessionId, "\u5BA2\u6237\u7AEF\u672A\u6CE8\u518C");
+          return;
+        }
+        const targetProxyId = clientWs.boundProxyId;
+        if (!targetProxyId || !registry.isProxyOnline(targetProxyId)) {
+          sendRemoteFileUploadUrlFailure(
+            clientWs,
+            msg.requestId,
+            msg.sessionId,
+            "\u5F53\u524D\u672A\u8FDE\u63A5\u5F00\u53D1\u673A",
+            ControlErrorCode.PROXY_OFFLINE
+          );
+          return;
+        }
+        const ownerProxyId = registry.getProxyForSession(msg.sessionId);
+        if (ownerProxyId && ownerProxyId !== targetProxyId) {
+          sendRemoteFileUploadUrlFailure(
+            clientWs,
+            msg.requestId,
+            msg.sessionId,
+            "\u4F1A\u8BDD\u4E0D\u5C5E\u4E8E\u5F53\u524D\u5F00\u53D1\u673A",
+            ControlErrorCode.SESSION_NOT_FOUND
+          );
+          return;
+        }
+        const { uploadUrl, expiresAt } = remoteFileBridge.createUploadUrl({
+          clientId: clientWs.clientId,
+          proxyId: targetProxyId,
+          sessionId: msg.sessionId,
+          kind: msg.kind,
+          fileName: msg.fileName,
+          mimeType: msg.mimeType,
+          size: msg.size
+        });
+        clientWs.send(
+          serializeControl({
+            type: "remote_file_upload_url_response",
+            requestId: msg.requestId,
+            sessionId: msg.sessionId,
+            success: true,
+            uploadUrl,
+            expiresAt
+          })
+        );
+        return;
+      }
       if (msg.type === "proxy_list_request") {
         const proxies = registry.listProxiesWithName().map((p) => ({
           ...p,
@@ -3367,6 +3564,348 @@ function createVoiceProviderRegistry(adapters) {
   };
 }
 
+// src/remote-file-bridge.ts
+import { nanoid as nanoid3 } from "nanoid";
+import { WebSocket as WebSocket11 } from "ws";
+var REMOTE_FILE_TOKEN_TTL_MS = 5 * 60 * 1e3;
+var REMOTE_FILE_METADATA_TIMEOUT_MS = 30 * 1e3;
+var REMOTE_FILE_UPLOAD_RESPONSE_TIMEOUT_MS = 60 * 1e3;
+function encodeContentDisposition(disposition, fileName) {
+  const type = disposition === "download" ? "attachment" : "inline";
+  const fallback = fileName.replace(/["\\\r\n]/g, "_") || "download";
+  return `${type}; filename="${fallback}"; filename*=UTF-8''${encodeURIComponent(fileName)}`;
+}
+function statusForErrorCode(errorCode) {
+  switch (errorCode) {
+    case ControlErrorCode.SESSION_NOT_FOUND:
+      return 404;
+    case ControlErrorCode.INVALID_PATH:
+      return 400;
+    case ControlErrorCode.PATH_ACCESS_DENIED:
+      return 403;
+    default:
+      return 500;
+  }
+}
+var RemoteFileBridge = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  tokens = /* @__PURE__ */ new Map();
+  uploadTokens = /* @__PURE__ */ new Map();
+  pendingStreams = /* @__PURE__ */ new Map();
+  pendingUploads = /* @__PURE__ */ new Map();
+  createUrl(input) {
+    this.cleanupExpiredTokens();
+    const token = nanoid3(32);
+    const expiresAt = Date.now() + REMOTE_FILE_TOKEN_TTL_MS;
+    this.tokens.set(token, {
+      token,
+      clientId: input.clientId,
+      proxyId: input.proxyId,
+      sessionId: input.sessionId,
+      path: input.path,
+      disposition: input.disposition,
+      expiresAt
+    });
+    return { url: `/api/remote-files/${token}`, expiresAt };
+  }
+  createUploadUrl(input) {
+    this.cleanupExpiredTokens();
+    const token = nanoid3(32);
+    const expiresAt = Date.now() + REMOTE_FILE_TOKEN_TTL_MS;
+    this.uploadTokens.set(token, {
+      token,
+      clientId: input.clientId,
+      proxyId: input.proxyId,
+      sessionId: input.sessionId,
+      kind: input.kind,
+      fileName: input.fileName,
+      mimeType: input.mimeType,
+      size: input.size,
+      expiresAt
+    });
+    return { uploadUrl: `/api/remote-uploads/${token}`, expiresAt };
+  }
+  handleHttpRequest(req, res) {
+    const tokenValue = req.params.token;
+    const token = typeof tokenValue === "string" ? this.tokens.get(tokenValue) : void 0;
+    if (!token || token.expiresAt <= Date.now()) {
+      if (typeof tokenValue === "string") this.tokens.delete(tokenValue);
+      res.status(404).json({ error: "remote_file_url_expired" });
+      return;
+    }
+    const proxyWs = this.deps.registry.getProxy(token.proxyId);
+    if (!proxyWs || proxyWs.readyState !== WebSocket11.OPEN) {
+      res.status(502).json({ error: "proxy_offline" });
+      return;
+    }
+    const streamId = nanoid3(21);
+    const metadataTimer = setTimeout(() => {
+      this.failStream(streamId, 504, "\u8BFB\u53D6\u6587\u4EF6\u5143\u6570\u636E\u8D85\u65F6");
+    }, REMOTE_FILE_METADATA_TIMEOUT_MS);
+    const pending = {
+      streamId,
+      token,
+      res,
+      metadataTimer,
+      headersSent: false,
+      finished: false
+    };
+    this.pendingStreams.set(streamId, pending);
+    res.on("close", () => {
+      if (pending.finished) return;
+      pending.finished = true;
+      this.pendingStreams.delete(streamId);
+      clearTimeout(metadataTimer);
+      this.sendCancel(token.proxyId, streamId);
+      this.deps.logger.info({ streamId, proxyId: token.proxyId }, "Remote file HTTP stream closed");
+    });
+    proxyWs.send(
+      serializeControl({
+        type: "remote_file_stream_request",
+        streamId,
+        sessionId: token.sessionId,
+        path: token.path,
+        disposition: token.disposition
+      })
+    );
+    this.deps.logger.info(
+      { streamId, proxyId: token.proxyId, sessionId: token.sessionId, path: token.path },
+      "Remote file HTTP stream requested"
+    );
+  }
+  handleUploadHttpRequest(req, res) {
+    const tokenValue = req.params.token;
+    const token = typeof tokenValue === "string" ? this.uploadTokens.get(tokenValue) : void 0;
+    if (!token || token.expiresAt <= Date.now()) {
+      if (typeof tokenValue === "string") this.uploadTokens.delete(tokenValue);
+      res.status(404).json({ error: "remote_file_upload_url_expired" });
+      return;
+    }
+    const proxyWs = this.deps.registry.getProxy(token.proxyId);
+    if (!proxyWs || proxyWs.readyState !== WebSocket11.OPEN) {
+      res.status(502).json({ error: "proxy_offline" });
+      return;
+    }
+    const uploadId = nanoid3(21);
+    const pending = {
+      uploadId,
+      token,
+      res,
+      chunkSeq: 0,
+      requestEnded: false,
+      finished: false,
+      responseTimer: null
+    };
+    this.pendingUploads.set(uploadId, pending);
+    proxyWs.send(
+      serializeControl({
+        type: "remote_file_upload_stream_request",
+        uploadId,
+        sessionId: token.sessionId,
+        kind: token.kind,
+        mimeType: token.mimeType,
+        ...token.fileName ? { fileName: token.fileName } : {},
+        ...token.size !== void 0 ? { size: token.size } : {}
+      })
+    );
+    req.on("data", (chunk) => {
+      if (pending.finished) return;
+      req.pause();
+      const frame = encodeFileStreamFrame(uploadId, pending.chunkSeq, Buffer.from(chunk));
+      pending.chunkSeq += 1;
+      proxyWs.send(frame, { binary: true }, (err) => {
+        if (err) {
+          this.failUpload(uploadId, 502, err.message);
+          return;
+        }
+        req.resume();
+      });
+    });
+    req.on("end", () => {
+      if (pending.finished) return;
+      pending.requestEnded = true;
+      pending.responseTimer = setTimeout(() => {
+        this.failUpload(uploadId, 504, "\u7B49\u5F85\u4E0A\u4F20\u5199\u5165\u7ED3\u679C\u8D85\u65F6");
+      }, REMOTE_FILE_UPLOAD_RESPONSE_TIMEOUT_MS);
+      proxyWs.send(serializeControl({ type: "remote_file_upload_stream_complete", uploadId }));
+    });
+    req.on("error", (err) => {
+      this.failUpload(uploadId, 400, err.message);
+    });
+    req.on("close", () => {
+      if (pending.finished || pending.requestEnded) return;
+      this.failUpload(uploadId, 499, "\u4E0A\u4F20\u8BF7\u6C42\u5DF2\u65AD\u5F00");
+    });
+    this.deps.logger.info(
+      { uploadId, proxyId: token.proxyId, sessionId: token.sessionId, kind: token.kind },
+      "Remote file HTTP upload requested"
+    );
+  }
+  handleProxyControl(proxyId, msg) {
+    if (msg.type === "remote_file_upload_stream_response") {
+      return this.handleUploadResponse(proxyId, msg);
+    }
+    const pending = this.pendingStreams.get(msg.streamId);
+    if (!pending) return true;
+    if (pending.token.proxyId !== proxyId) {
+      this.deps.logger.warn(
+        { streamId: msg.streamId, expectedProxyId: pending.token.proxyId, proxyId },
+        "Remote file stream control ignored: proxy mismatch"
+      );
+      return true;
+    }
+    if (msg.type === "remote_file_stream_response") {
+      this.handleStreamResponse(pending, msg);
+      return true;
+    }
+    this.handleStreamComplete(pending, msg);
+    return true;
+  }
+  handleProxyBinary(proxyId, data) {
+    const decoded = decodeFileStreamFrame(data);
+    if (!decoded) return false;
+    const pending = this.pendingStreams.get(decoded.streamId);
+    if (!pending) return true;
+    if (pending.token.proxyId !== proxyId) {
+      this.deps.logger.warn(
+        { streamId: decoded.streamId, expectedProxyId: pending.token.proxyId, proxyId },
+        "Remote file stream chunk ignored: proxy mismatch"
+      );
+      return true;
+    }
+    if (!pending.headersSent || pending.finished) return true;
+    pending.res.write(Buffer.from(decoded.data));
+    return true;
+  }
+  handleStreamResponse(pending, msg) {
+    clearTimeout(pending.metadataTimer);
+    if (!msg.success) {
+      this.failStream(
+        pending.streamId,
+        statusForErrorCode(msg.errorCode),
+        msg.error ?? "\u8BFB\u53D6\u6587\u4EF6\u5931\u8D25",
+        msg.errorCode
+      );
+      return;
+    }
+    pending.headersSent = true;
+    pending.res.status(200);
+    pending.res.setHeader("Content-Type", msg.mimeType ?? "application/octet-stream");
+    pending.res.setHeader("Cache-Control", "no-store");
+    pending.res.setHeader("X-Content-Type-Options", "nosniff");
+    if (msg.size !== void 0) {
+      pending.res.setHeader("Content-Length", String(msg.size));
+    }
+    pending.res.setHeader(
+      "Content-Disposition",
+      encodeContentDisposition(pending.token.disposition, msg.fileName ?? "download")
+    );
+    pending.res.flushHeaders();
+  }
+  handleStreamComplete(pending, msg) {
+    clearTimeout(pending.metadataTimer);
+    pending.finished = true;
+    this.pendingStreams.delete(pending.streamId);
+    if (!msg.success) {
+      if (!pending.headersSent) {
+        this.writeJsonError(
+          pending.res,
+          statusForErrorCode(msg.errorCode),
+          msg.error ?? "\u8BFB\u53D6\u6587\u4EF6\u5931\u8D25",
+          msg.errorCode
+        );
+      } else {
+        pending.res.destroy(new Error(msg.error ?? "Remote file stream failed"));
+      }
+      return;
+    }
+    pending.res.end();
+  }
+  handleUploadResponse(proxyId, msg) {
+    const pending = this.pendingUploads.get(msg.uploadId);
+    if (!pending) return true;
+    if (pending.token.proxyId !== proxyId) {
+      this.deps.logger.warn(
+        { uploadId: msg.uploadId, expectedProxyId: pending.token.proxyId, proxyId },
+        "Remote file upload response ignored: proxy mismatch"
+      );
+      return true;
+    }
+    pending.finished = true;
+    this.pendingUploads.delete(msg.uploadId);
+    if (pending.responseTimer) clearTimeout(pending.responseTimer);
+    if (!msg.success) {
+      this.writeJsonError(
+        pending.res,
+        statusForErrorCode(msg.errorCode),
+        msg.error ?? "\u4E0A\u4F20\u6587\u4EF6\u5931\u8D25",
+        msg.errorCode
+      );
+      return true;
+    }
+    pending.res.status(200).json({
+      sessionId: msg.sessionId,
+      success: true,
+      path: msg.path
+    });
+    return true;
+  }
+  failStream(streamId, status, error, errorCode) {
+    const pending = this.pendingStreams.get(streamId);
+    if (!pending) return;
+    pending.finished = true;
+    this.pendingStreams.delete(streamId);
+    clearTimeout(pending.metadataTimer);
+    this.sendCancel(pending.token.proxyId, streamId);
+    if (!pending.headersSent) {
+      this.writeJsonError(pending.res, status, error, errorCode);
+    } else {
+      pending.res.destroy(new Error(error));
+    }
+  }
+  failUpload(uploadId, status, error, errorCode) {
+    const pending = this.pendingUploads.get(uploadId);
+    if (!pending) return;
+    pending.finished = true;
+    this.pendingUploads.delete(uploadId);
+    if (pending.responseTimer) clearTimeout(pending.responseTimer);
+    this.sendUploadCancel(pending.token.proxyId, uploadId);
+    if (!pending.res.headersSent) {
+      this.writeJsonError(pending.res, status, error, errorCode);
+    } else {
+      pending.res.destroy(new Error(error));
+    }
+  }
+  writeJsonError(res, status, error, errorCode) {
+    res.status(status).json({
+      error,
+      ...errorCode ? { errorCode } : {}
+    });
+  }
+  sendCancel(proxyId, streamId) {
+    const proxyWs = this.deps.registry.getProxy(proxyId);
+    if (!proxyWs || proxyWs.readyState !== WebSocket11.OPEN) return;
+    proxyWs.send(serializeControl({ type: "remote_file_stream_cancel", streamId }));
+  }
+  sendUploadCancel(proxyId, uploadId) {
+    const proxyWs = this.deps.registry.getProxy(proxyId);
+    if (!proxyWs || proxyWs.readyState !== WebSocket11.OPEN) return;
+    proxyWs.send(serializeControl({ type: "remote_file_upload_stream_cancel", uploadId }));
+  }
+  cleanupExpiredTokens() {
+    const now = Date.now();
+    for (const [token, meta] of this.tokens) {
+      if (meta.expiresAt <= now) this.tokens.delete(token);
+    }
+    for (const [token, meta] of this.uploadTokens) {
+      if (meta.expiresAt <= now) this.uploadTokens.delete(token);
+    }
+  }
+};
+
 // src/server.ts
 var MODULE_DIR = dirname3(fileURLToPath2(import.meta.url));
 var PACKAGED_FONTS_DIR = resolve(MODULE_DIR, "../assets/fonts");
@@ -3399,6 +3938,7 @@ function createRelayServer(options) {
     );
   }
   const registry = new RelayRegistry();
+  const remoteFileBridge = new RemoteFileBridge({ registry, logger });
   const voiceConfigStore = createVoiceConfigStore({
     dataDir,
     defaults: options.voiceDefaults
@@ -3455,6 +3995,12 @@ function createRelayServer(options) {
       getClientToken: () => clientToken ?? null
     })
   );
+  app.get("/api/remote-files/:token", (req, res) => {
+    remoteFileBridge.handleHttpRequest(req, res);
+  });
+  app.put("/api/remote-uploads/:token", (req, res) => {
+    remoteFileBridge.handleUploadHttpRequest(req, res);
+  });
   const httpServer = createServer(app);
   const proxyWss = new WebSocketServer({ noServer: true });
   const clientWss = new WebSocketServer({ noServer: true });
@@ -3522,13 +4068,22 @@ function createRelayServer(options) {
     socket.destroy();
   });
   proxyWss.on("connection", (ws) => {
-    handleProxyConnection(ws, registry, logger, relayChaos);
+    handleProxyConnection(ws, registry, logger, relayChaos, remoteFileBridge);
   });
   clientWss.on("connection", (ws, request) => {
-    handleClientConnection(ws, registry, logger, relayChaos, voiceConfigStore, voiceProviders, {
-      userAgent: firstHeaderValue(request.headers["user-agent"]),
-      remoteAddress: requestRemoteAddress(request)
-    });
+    handleClientConnection(
+      ws,
+      registry,
+      logger,
+      relayChaos,
+      voiceConfigStore,
+      voiceProviders,
+      remoteFileBridge,
+      {
+        userAgent: firstHeaderValue(request.headers["user-agent"]),
+        remoteAddress: requestRemoteAddress(request)
+      }
+    );
   });
   voiceAsrWss.on("connection", (ws) => {
     handleVoiceAsrConnection(ws, voiceConfigStore, logger, voiceProviders);
@@ -3598,4 +4153,4 @@ export {
   parseRelayChaosFromEnv,
   createRelayServer
 };
-//# sourceMappingURL=chunk-UV7DNQUI.js.map
+//# sourceMappingURL=chunk-XY4ATTV2.js.map