@walkhi/code-relax 0.1.0-beta.76 → 0.1.0-beta.79

package/dist/src/dots-message-images.mjs

@@ -254,7 +254,6 @@ export class DotsMessageImages {
     }
     const headers = await this.authorization(image.identity);
     await this.metadata(image, headers);
-    if (image.size > this.maxBytes) throw new Error('点点附件超过 20 MiB 下载上限。');
     const revision = image.id;
     const { offset, length } = fileRange(query, image.size, revision);
     if (!offset || !image.downloadUrl) image.downloadUrl = await this.contentUrl(image, headers, true);

package/dist/src/dots-room-client.mjs

@@ -1,157 +1,163 @@
-import http2 from 'node:http2';
-import { CelsiusClient } from './celsius-client.mjs';
-
-const topic = 'calpico-chatgpt-messaging';
-const identityKey = identity => JSON.stringify([identity?.accountId, identity?.userId]);
-
-// Desktop 26.1016.6573.0: the DM API and Celsius share the kernel account,
-// but are independent of the hosted execution socket. Never replay a POST.
-export class DotsRoomClient extends CelsiusClient {
-  constructor(transport) {
-    super({ topics: [topic] }); this.transport = transport;
-    this.getConnection = () => this.request('/celsius/ws/user');
-    this.controllers = new Set(); this.routes = new Map();
-  }
-
-  async authorization() {
-    const identity = this.transport.profileIdentity, generation = this.generation;
-    const auth = await this.transport.localServer.request('getAuthStatus', { includeToken: true, refreshToken: false });
-    const principal = auth.authToken && JSON.parse(Buffer.from(auth.authToken.split('.')[1], 'base64url'))['https://api.openai.com/auth'];
-    if (!identity?.accountId || principal?.chatgpt_account_id !== identity.accountId
-      || principal.chatgpt_user_id !== identity.userId || generation !== this.generation
-      || identityKey(identity) !== identityKey(this.transport.profileIdentity)) throw new Error('点点账号已变化，请重新连接。');
-    return { identity, generation, headers: { authorization: `Bearer ${auth.authToken}`,
-      'chatgpt-account-id': identity.accountId, 'user-agent': 'Code-Relax/0.1.0' } };
-  }
-
-  async request(route, { method = 'GET', body, contentType, signal, onEvent, rawResponse = false } = {}) {
-    const auth = await this.authorization();
-    const controller = new AbortController(); this.controllers.add(controller);
-    const cancelled = () => controller.abort(signal.reason);
-    signal?.addEventListener('abort', cancelled, { once: true });
-    if (signal?.aborted) cancelled();
-    let sent = false, status, timer, responseKind = 'none';
-    const started = Date.now();
-    const clientId = method === 'POST' && /^[a-f0-9-]{36}$/i.test(body?.request_id || '') ? body.request_id : undefined;
-    try {
-      return await new Promise((resolve, reject) => {
-        const session = http2.connect('https://chatgpt.com');
-        let request, settled = false, bytes = 0, text = '';
-        const current = () => auth.generation === this.generation
-          && identityKey(auth.identity) === identityKey(this.transport.profileIdentity);
-        const finish = (error, value) => {
-          if (settled) return; settled = true;
-          clearTimeout(timer); controller.signal.removeEventListener('abort', abort);
-          request?.destroy(); session.destroy();
-          if (error) {
-            error.details = { ...error.details, ...(status ? { upstreamStatus: status } : {}), responseKind };
-            if (!controller.signal.aborted) console.error(JSON.stringify({ time: new Date().toISOString(), event: 'dots-room-request', method,
-              route: route.split('?')[0], clientId, status: status || 0, responseKind,
-              ms: Date.now() - started, outcome: 'failed' }));
-            if (method !== 'GET' && !onEvent) error.deliveryUnknown = sent && !(status >= 400 && status < 500 && status !== 408);
-            reject(error);
-          } else resolve(value);
-        };
-        const abort = () => finish(controller.signal.reason || new Error('点点请求已取消。'));
-        controller.signal.addEventListener('abort', abort, { once: true });
-        session.on('error', error => finish(error));
-        if (controller.signal.aborted) { abort(); return; }
-        const roomRoute = method === 'POST' ? /^\/messaging\/rooms\/([^/]+)\/messages$/.exec(route)?.[1] : null;
-        request = session.request({ ':method': method, ':path': `/backend-api${route}`, ...auth.headers,
-          accept: onEvent ? 'text/event-stream' : 'application/json',
-          ...(body != null ? { 'content-type': contentType || 'application/json' } : {}),
-          ...(roomRoute && this.routes.has(roomRoute) ? { 'x-openai-thread-route': this.routes.get(roomRoute) } : {}) });
-        timer = setTimeout(() => finish(new Error('点点请求超时，请重新核对状态。')), 30000);
-        request.setEncoding('utf8');
-        request.on('response', headers => {
-          status = headers[':status'];
-          const type = String(headers['content-type'] || '').split(';')[0].trim().toLowerCase();
-          responseKind = headers['cf-mitigated'] === 'challenge' ? 'challenge'
-            : type === 'application/json' ? 'json' : type === 'text/html' ? 'html' : type === 'text/event-stream' ? 'sse' : 'other';
-          if (roomRoute && current()) {
-            // Desktop replaces the route on every send response, including removal.
-            this.routes.delete(roomRoute);
-            const routeHint = headers['x-openai-thread-route'];
-            if (typeof routeHint === 'string' && routeHint && routeHint.length <= 1024) {
-              if (this.routes.size >= 128) this.routes.clear();
-              this.routes.set(roomRoute, routeHint);
-            }
-          }
-          if (status < 200 || status >= 300) {
-            const message = status === 401 ? '点点登录状态需要恢复，请重新连接。'
-              : status === 403 ? '点点服务拒绝访问（HTTP 403），请稍后重试。'
-                : status === 404 ? '点点消息暂不可用，请稍后重新同步。'
-                : status === 429 ? '点点暂时繁忙，请稍后再试。' : '点点请求尚未完成，请稍后核对。';
-            finish(Object.assign(new Error(message), { status }));
-          } else if (roomRoute || onEvent) {
-            console.log(JSON.stringify({ time: new Date().toISOString(), event: 'dots-room-request', method,
-              route: route.split('?')[0], clientId, status, responseKind, ms: Date.now() - started, outcome: 'response' }));
-          }
-        });
-        request.on('data', chunk => {
-          if (!current()) { finish(new Error('点点账号已变化，请重新连接。')); return; }
-          bytes += Buffer.byteLength(chunk); text += chunk;
-          if (onEvent) {
-            text = text.replace(/\r\n/g, '\n');
-            let end;
-            while ((end = text.indexOf('\n\n')) >= 0) {
-              const frame = text.slice(0, end); text = text.slice(end + 2);
-              const data = frame.split('\n').filter(line => line.startsWith('data:')).map(line => line.slice(5).trimStart()).join('\n');
-              // Desktop's ChatGPT SSE treats [DONE] as completion, not JSON.
-              if (data.trim() === '[DONE]') { finish(null, null); return; }
-              if (data) try { onEvent(JSON.parse(data)); clearTimeout(timer); } catch (error) { finish(error); return; }
-            }
-            bytes = Buffer.byteLength(text);
-          }
-          if (bytes > 8 * 1024 * 1024) finish(new Error('点点响应超出单次读取上限。'));
-        });
-        request.on('error', error => finish(error));
-        request.on('end', () => {
-          if (!current()) { finish(new Error('点点账号已变化，请重新连接。')); return; }
-          try { finish(null, onEvent ? null : rawResponse ? text : text ? JSON.parse(text) : null); } catch (error) { finish(error); }
-        });
-        request.on('close', () => { if (!settled) finish(new Error('点点请求连接已断开。')); });
-        // end() can queue data before TLS connects. Only a ready HTTP/2 stream
-        // has been assigned an ID and may have submitted the request.
-        sent = !request.pending;
-        request.once('ready', () => { sent = true; });
-        request.end(body == null ? undefined : Buffer.isBuffer(body) ? body : JSON.stringify(body));
-      });
-    } finally { this.controllers.delete(controller); signal?.removeEventListener('abort', cancelled); }
-  }
-
-  async roomId(threadId) {
-    let profile = this.transport.liveProfiles.get(threadId);
-    if (!profile?.messagingRoomId) {
-      const value = await this.request(`/tbo/by-thread/${encodeURIComponent(threadId)}`);
-      profile = { messagingRoomId: value?.messaging_room_id };
-    }
-    if (typeof profile.messagingRoomId !== 'string' || !profile.messagingRoomId) throw new Error('点点消息房间暂不可用。');
-    return profile.messagingRoomId;
-  }
-
-  async room(id) {
-    const room = await this.request(`/messaging/rooms/${encodeURIComponent(id)}`);
-    if (room?.id !== id || room.type !== 'DM' || room.app_source !== 'chatgpt:messaging' || !Array.isArray(room.members)) {
-      throw new Error('点点消息房间身份不匹配。');
-    }
-    return room;
-  }
-
-  async messages(roomId, { before, after, around, limit = 20 } = {}) {
-    const query = new URLSearchParams({ limit: String(limit), ...(before ? { before } : {}),
-      ...(after ? { after } : {}), ...(around ? { around } : {}) });
-    const page = await this.request(`/messaging/rooms/${encodeURIComponent(roomId)}/messages?${query}`);
-    if (!Array.isArray(page?.items) || page.items.some(message => typeof message.id !== 'string' || !message.id)) throw new Error('点点消息页格式无效。');
-    // Null prev_cursor is also returned for nonempty middle pages. Desktop uses
-    // the first message ID; only an empty page proves that history is exhausted.
-    return { items: page.items, before: page.prev_cursor ?? page.items[0]?.id ?? null,
-      after: page.next_cursor ?? (after && page.items.length >= limit ? page.items.at(-1)?.id : null) };
-  }
-
-  close() {
-    super.close();
-    for (const controller of this.controllers) controller.abort(new Error('点点连接已结束。'));
-    this.controllers.clear(); this.routes.clear();
-  }
-}
+import http2 from 'node:http2';
+import { Readable } from 'node:stream';
+import { CelsiusClient } from './celsius-client.mjs';
+
+const topic = 'calpico-chatgpt-messaging';
+const identityKey = identity => JSON.stringify([identity?.accountId, identity?.userId]);
+
+// Desktop 26.1016.6573.0: the DM API and Celsius share the kernel account,
+// but are independent of the hosted execution socket. Never replay a POST.
+export class DotsRoomClient extends CelsiusClient {
+  constructor(transport) {
+    super({ topics: [topic] }); this.transport = transport;
+    this.getConnection = () => this.request('/celsius/ws/user');
+    this.controllers = new Set(); this.routes = new Map();
+  }
+
+  async authorization() {
+    const identity = this.transport.profileIdentity, generation = this.generation;
+    const auth = await this.transport.localServer.request('getAuthStatus', { includeToken: true, refreshToken: false });
+    const principal = auth.authToken && JSON.parse(Buffer.from(auth.authToken.split('.')[1], 'base64url'))['https://api.openai.com/auth'];
+    if (!identity?.accountId || principal?.chatgpt_account_id !== identity.accountId
+      || principal.chatgpt_user_id !== identity.userId || generation !== this.generation
+      || identityKey(identity) !== identityKey(this.transport.profileIdentity)) throw new Error('点点账号已变化，请重新连接。');
+    return { identity, generation, headers: { authorization: `Bearer ${auth.authToken}`,
+      'chatgpt-account-id': identity.accountId, 'user-agent': 'Code-Relax/0.1.0' } };
+  }
+
+  async request(route, { method = 'GET', body, contentType, signal, onEvent, rawResponse = false } = {}) {
+    const auth = await this.authorization();
+    const controller = new AbortController(); this.controllers.add(controller);
+    const cancelled = () => controller.abort(signal.reason);
+    signal?.addEventListener('abort', cancelled, { once: true });
+    if (signal?.aborted) cancelled();
+    let sent = false, status, timer, responseKind = 'none';
+    const started = Date.now();
+    const clientId = method === 'POST' && /^[a-f0-9-]{36}$/i.test(body?.request_id || '') ? body.request_id : undefined;
+    try {
+      return await new Promise((resolve, reject) => {
+        const session = http2.connect('https://chatgpt.com');
+        let request, settled = false, bytes = 0, text = '';
+        const current = () => auth.generation === this.generation
+          && identityKey(auth.identity) === identityKey(this.transport.profileIdentity);
+        const finish = (error, value) => {
+          if (settled) return; settled = true;
+          clearTimeout(timer); controller.signal.removeEventListener('abort', abort);
+          request?.destroy(); session.destroy();
+          if (error) {
+            error.details = { ...error.details, ...(status ? { upstreamStatus: status } : {}), responseKind };
+            if (!controller.signal.aborted) console.error(JSON.stringify({ time: new Date().toISOString(), event: 'dots-room-request', method,
+              route: route.split('?')[0], clientId, status: status || 0, responseKind,
+              ms: Date.now() - started, outcome: 'failed' }));
+            if (method !== 'GET' && !onEvent) error.deliveryUnknown = sent && !(status >= 400 && status < 500 && status !== 408);
+            reject(error);
+          } else resolve(value);
+        };
+        const abort = () => finish(controller.signal.reason || new Error('点点请求已取消。'));
+        controller.signal.addEventListener('abort', abort, { once: true });
+        session.on('error', error => finish(error));
+        if (controller.signal.aborted) { abort(); return; }
+        const roomRoute = method === 'POST' ? /^\/messaging\/rooms\/([^/]+)\/messages$/.exec(route)?.[1] : null;
+        request = session.request({ ':method': method, ':path': `/backend-api${route}`, ...auth.headers,
+          accept: onEvent ? 'text/event-stream' : 'application/json',
+          ...(body != null ? { 'content-type': contentType || 'application/json' } : {}),
+          ...(roomRoute && this.routes.has(roomRoute) ? { 'x-openai-thread-route': this.routes.get(roomRoute) } : {}) });
+        timer = setTimeout(() => finish(new Error('点点请求超时，请重新核对状态。')), 30000);
+        request.setEncoding('utf8');
+        request.on('response', headers => {
+          status = headers[':status'];
+          const type = String(headers['content-type'] || '').split(';')[0].trim().toLowerCase();
+          responseKind = headers['cf-mitigated'] === 'challenge' ? 'challenge'
+            : type === 'application/json' ? 'json' : type === 'text/html' ? 'html' : type === 'text/event-stream' ? 'sse' : 'other';
+          if (roomRoute && current()) {
+            // Desktop replaces the route on every send response, including removal.
+            this.routes.delete(roomRoute);
+            const routeHint = headers['x-openai-thread-route'];
+            if (typeof routeHint === 'string' && routeHint && routeHint.length <= 1024) {
+              if (this.routes.size >= 128) this.routes.clear();
+              this.routes.set(roomRoute, routeHint);
+            }
+          }
+          if (status < 200 || status >= 300) {
+            const message = status === 401 ? '点点登录状态需要恢复，请重新连接。'
+              : status === 403 ? '点点服务拒绝访问（HTTP 403），请稍后重试。'
+                : status === 404 ? '点点消息暂不可用，请稍后重新同步。'
+                : status === 429 ? '点点暂时繁忙，请稍后再试。' : '点点请求尚未完成，请稍后核对。';
+            finish(Object.assign(new Error(message), { status }));
+          } else if (roomRoute || onEvent) {
+            console.log(JSON.stringify({ time: new Date().toISOString(), event: 'dots-room-request', method,
+              route: route.split('?')[0], clientId, status, responseKind, ms: Date.now() - started, outcome: 'response' }));
+          }
+        });
+        request.on('data', chunk => {
+          if (!current()) { finish(new Error('点点账号已变化，请重新连接。')); return; }
+          bytes += Buffer.byteLength(chunk); text += chunk;
+          if (onEvent) {
+            text = text.replace(/\r\n/g, '\n');
+            let end;
+            while ((end = text.indexOf('\n\n')) >= 0) {
+              const frame = text.slice(0, end); text = text.slice(end + 2);
+              const data = frame.split('\n').filter(line => line.startsWith('data:')).map(line => line.slice(5).trimStart()).join('\n');
+              // Desktop's ChatGPT SSE treats [DONE] as completion, not JSON.
+              if (data.trim() === '[DONE]') { finish(null, null); return; }
+              if (data) try { onEvent(JSON.parse(data)); clearTimeout(timer); } catch (error) { finish(error); return; }
+            }
+            bytes = Buffer.byteLength(text);
+          }
+          if (bytes > 8 * 1024 * 1024) finish(new Error('点点响应超出单次读取上限。'));
+        });
+        request.on('error', error => finish(error));
+        request.on('end', () => {
+          if (!current()) { finish(new Error('点点账号已变化，请重新连接。')); return; }
+          try { finish(null, onEvent ? null : rawResponse ? text : text ? JSON.parse(text) : null); } catch (error) { finish(error); }
+        });
+        request.on('close', () => { if (!settled) finish(new Error('点点请求连接已断开。')); });
+        // end() can queue data before TLS connects. Only a ready HTTP/2 stream
+        // has been assigned an ID and may have submitted the request.
+        sent = !request.pending;
+        request.once('ready', () => { sent = true; });
+        if (body instanceof Blob) {
+          const source = Readable.fromWeb(body.stream());
+          source.on('error', error => finish(error));
+          request.on('close', () => source.destroy());
+          source.pipe(request);
+        } else request.end(body == null ? undefined : Buffer.isBuffer(body) ? body : JSON.stringify(body));
+      });
+    } finally { this.controllers.delete(controller); signal?.removeEventListener('abort', cancelled); }
+  }
+
+  async roomId(threadId) {
+    let profile = this.transport.liveProfiles.get(threadId);
+    if (!profile?.messagingRoomId) {
+      const value = await this.request(`/tbo/by-thread/${encodeURIComponent(threadId)}`);
+      profile = { messagingRoomId: value?.messaging_room_id };
+    }
+    if (typeof profile.messagingRoomId !== 'string' || !profile.messagingRoomId) throw new Error('点点消息房间暂不可用。');
+    return profile.messagingRoomId;
+  }
+
+  async room(id) {
+    const room = await this.request(`/messaging/rooms/${encodeURIComponent(id)}`);
+    if (room?.id !== id || room.type !== 'DM' || room.app_source !== 'chatgpt:messaging' || !Array.isArray(room.members)) {
+      throw new Error('点点消息房间身份不匹配。');
+    }
+    return room;
+  }
+
+  async messages(roomId, { before, after, around, limit = 20 } = {}) {
+    const query = new URLSearchParams({ limit: String(limit), ...(before ? { before } : {}),
+      ...(after ? { after } : {}), ...(around ? { around } : {}) });
+    const page = await this.request(`/messaging/rooms/${encodeURIComponent(roomId)}/messages?${query}`);
+    if (!Array.isArray(page?.items) || page.items.some(message => typeof message.id !== 'string' || !message.id)) throw new Error('点点消息页格式无效。');
+    // Null prev_cursor is also returned for nonempty middle pages. Desktop uses
+    // the first message ID; only an empty page proves that history is exhausted.
+    return { items: page.items, before: page.prev_cursor ?? page.items[0]?.id ?? null,
+      after: page.next_cursor ?? (after && page.items.length >= limit ? page.items.at(-1)?.id : null) };
+  }
+
+  close() {
+    super.close();
+    for (const controller of this.controllers) controller.abort(new Error('点点连接已结束。'));
+    this.controllers.clear(); this.routes.clear();
+  }
+}

package/dist/src/dots-task-files.mjs

@@ -9,7 +9,7 @@ export async function uploadTaskFiles(files, { uploadsRoot, client, current, fet
   for (const file of uploads) {
     current();
     const reserved = await client.request('/files', { method: 'POST', body: {
-      file_name: file.name, file_size: file.bytes.length, mime_type: file.mimeType,
+      file_name: file.name, file_size: file.bytes.size ?? file.bytes.length, mime_type: file.mimeType,
       use_case: 'codex', store_in_library: false, timezone_offset_min: new Date().getTimezoneOffset(), reset_rate_limits: false,
     } });
     current();
@@ -22,7 +22,7 @@ export async function uploadTaskFiles(files, { uploadsRoot, client, current, fet
       if (!uploadUrl) throw new Error('云端文件上传地址缺少参数。');
       const boundary = `relax-${randomUUID()}`;
       const name = file.name.replaceAll('"', '%22').replaceAll('\\', '%5C');
-      const body = Buffer.concat([Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${name}"\r\nContent-Type: ${file.mimeType}\r\n\r\n`),
+      const body = new Blob([Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${name}"\r\nContent-Type: ${file.mimeType}\r\n\r\n`),
         file.bytes, Buffer.from(`\r\n--${boundary}\r\nContent-Disposition: form-data; name="upload_url"\r\n\r\n${uploadUrl}\r\n--${boundary}--\r\n`)]);
       await client.request(url.pathname.slice('/backend-api'.length) + url.search, {
         method: 'POST', body, contentType: `multipart/form-data; boundary=${boundary}`, rawResponse: true,

package/dist/src/file-upload-session.mjs

@@ -56,9 +56,16 @@ export function createFileUploadSession(root) {
     completed.clear(); files.clear(); completedBytes = 0;
   };
   return {
-    async receive(message) {
+    async receive(message, { relayed = false } = {}) {
       if (!message || typeof message !== 'object') throw new Error('无效的文件上传请求');
       if (message.type === 'cancel') { await clear(); return { type: 'cancelled' }; }
+      // Recheck the complete batch on every relayed request, including resume
+      // and commit after a direct connection has been replaced.
+      if (relayed) {
+        const originals = [...files.values()].filter(file => !file.previewOf);
+        if (originals.some(file => file.size > MAX_FILE_BYTES)) throw new Error('服务器转发仅支持单个文件不超过 20 MiB，请使用局域网或 RTC 直连');
+        if (originals.reduce((sum, file) => sum + file.size, 0) > MAX_TOTAL_BYTES) throw new Error('服务器转发仅支持每批合计不超过 40 MiB，请使用局域网或 RTC 直连');
+      }
       if (message.type === 'commit') {
         if (upload) throw new Error('文件尚未上传完成');
         committed = true;
@@ -86,14 +93,14 @@ export function createFileUploadSession(root) {
         if (committed) throw new Error('文件批次已提交');
         if (upload) throw new Error('已有文件正在上传');
         if (!validName(message.name)) throw new Error('文件名无效');
-        if (!Number.isSafeInteger(message.size) || message.size < 1 || message.size > MAX_FILE_BYTES) {
-          throw new Error('单个文件不得超过 20 MiB');
+        if (!Number.isSafeInteger(message.size) || message.size < 1) {
+          throw new Error('文件大小无效');
         }
+        if (relayed && message.size > MAX_FILE_BYTES) throw new Error('服务器转发仅支持单个文件不超过 20 MiB，请使用局域网或 RTC 直连');
         const parent = message.previewOf ? completed.get(message.previewOf) : null;
         if (message.previewOf && (!parent || parent.preview || message.size > FILE_CHUNK_BYTES)) throw new Error('预览图关联无效或超过 256 KiB');
-        if (!parent && (completed.size >= MAX_FILE_COUNT || completedBytes + message.size > MAX_TOTAL_BYTES)) {
-          throw new Error('每条消息最多 4 个文件，合计不超过 40 MiB');
-        }
+        if (!parent && completed.size >= MAX_FILE_COUNT) throw new Error('每条消息最多 4 个文件');
+        if (!parent && relayed && completedBytes + message.size > MAX_TOTAL_BYTES) throw new Error('服务器转发仅支持每批合计不超过 40 MiB，请使用局域网或 RTC 直连');
         if (!/^[a-f0-9]{64}$/i.test(message.sha256 || '')) throw new Error('文件校验值无效');
         const id = crypto.randomUUID();
         await fs.mkdir(directory, { recursive: true });

package/dist/src/lan-socket-server.mjs

@@ -84,7 +84,7 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
         if (binary) {
           if (!authenticated || purpose !== 'upload' || !chunk || bytes.length !== chunk.length) throw new Error('无效的文件分片');
           const current = chunk; chunk = undefined;
-          reply(await upload.receive({ ...current, data: bytes })); return;
+          reply(await upload.receive({ ...current, data: bytes }, { relayed: fileRelay })); return;
         }
         if (bytes.length > 16 * 1024 || chunk) throw new Error('无效的文件请求');
         const message = JSON.parse(bytes.toString());
@@ -142,8 +142,8 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
             Object.assign(uploadEntry, { ws, released });
             upload = uploadEntry.session;
           }
-          reply({ type: 'ready', version: 3, purpose, maxDownloadBytes: FILE_READ_LIMIT, maxFileBytes: MAX_FILE_BYTES, maxFileCount: MAX_FILE_COUNT,
-            maxTotalBytes: MAX_TOTAL_BYTES, chunkBytes: FILE_CHUNK_BYTES, uploadSessionId: uploadId });
+          reply({ type: 'ready', version: 4, purpose, maxDownloadBytes: fileRelay ? FILE_READ_LIMIT : null, maxFileBytes: fileRelay ? MAX_FILE_BYTES : null, maxFileCount: MAX_FILE_COUNT,
+            maxTotalBytes: fileRelay ? MAX_TOTAL_BYTES : null, chunkBytes: FILE_CHUNK_BYTES, uploadSessionId: uploadId });
           return;
         }
         if (purpose === 'download') {
@@ -154,6 +154,7 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
             json(status, body) { reply({ type: 'error', status, error: body?.error || '文件读取失败' }); },
             filePart(metadata, data) {
               if (stopped || ws.readyState !== WebSocket.OPEN) return;
+              if (fileRelay && metadata.size > FILE_READ_LIMIT) throw new Error('服务器转发仅支持下载不超过 20 MiB 的文件，请使用局域网或 RTC 直连');
               if (!Buffer.isBuffer(data) || data.length > FILE_CHUNK_BYTES || ws.bufferedAmount > 1024 * 1024) throw new Error('文件接收过慢或分片无效');
               reply({ type: 'part', ...metadata, length: data.length });
               ws.send(data);
@@ -165,7 +166,7 @@ export function attachLanSocket(server, { token, dispatch, authorizeDevice = ()
           if (!Number.isSafeInteger(message.length) || message.length < 1 || message.length > FILE_CHUNK_BYTES) throw new Error('文件分片大小无效');
           chunk = message; return;
         }
-        reply(await upload.receive(message));
+        reply(await upload.receive(message, { relayed: fileRelay }));
         if (message.type === 'commit') uploadEntry.committed = true;
         if (message.type === 'cancel') {
           await expireUpload(uploadId, uploadEntry);