feat: support chunked transfers and consolidate relay hardening

[sidmorizon]

The relay's three-second per-method limit rejects consecutive Prime Transfer chunks. This change adds bounded chunk forwarding for actual transfer progress, closes message-envelope and response-channel abuse paths, fixes disconnect-during-join admission, combines #26/#27, and consolidates all ten dependency update PRs.

Transfer progress and compatibility

• Advertise chunkedTransferVersion: 1 in successful room-join responses.
• Allow up to 512 sendTransferChunk requests per connection per second, with at most 64 KiB Base64 data and 72 KiB for the entire JSON envelope. Validate transfer ID, index, and parameters. Invalid chunk input returns 1001; actual chunk throttling returns 1100.
• Keep the existing single-message transfer API. Clients enable chunking only when both the relay and peer advertise support; otherwise updated clients fall back to the existing loading flow. Percentage progress requires both clients and the relay to support it.
• Preserve the default rate limit for other methods, with the bounded room-query allowance described below. Encryption algorithms and client key derivation are unchanged.

Historical client binaries have not been tested across every version combination.

Relay security: #26 and #27

• Combine the overlapping authorization checks into one guard: the sender must belong to the room in both Socket.IO and the authoritative RoomManager. This covers client-to-client requests, responses, and transfer chunks.
• Return the same empty list for non-member and missing-room user queries, preserving legacy missing-room behavior without exposing room existence. Bound getRoomUsers with a per-connection token bucket (capacity 10, refill 5/second), allowing shipped App pairing/UI queries to overlap with one-second CLI polling. Notify existing room members with user-joined after the peer has joined.
• Return relay rejections on the originating C2S or C2C response channel, preserving request correlation fields even when the two bridges reuse an ID.
• Refresh room activity only after authorized requests pass validation and rate limits, or after authorized responses pass envelope validation. Active transfers survive the idle timeout; invalid and rejected traffic does not renew rooms.
• Strip server stacks at the bridge's actual outbound response path, including plain-object errors, and omit them from direct E2eeError serialization. Server crash logging remains available.
• Preserve permissive origin reflection and credentials: true, including credentialed browser polling; remove the unused allowlist configuration. Retain server-generated room-key fields for wire compatibility.
• Bind relay events to their matching REQUEST/RESPONSE types and validate bounded bridge metadata. Cap complete response envelopes at 256 KiB and 512 responses/second. Both relay directions, including rejected traffic, share 1024 messages/second and 32 MiB/second per connection (byte budget is at least the configured legacy packet limit). Disconnect sockets exceeding shared/response limits without response-to-response error loops. The legacy request size remains MAX_MESSAGE_SIZE (default 10 MiB).
• Reserve room capacity while adapter admission is pending, publish members only after success, and release reservations on disconnect/failure. Keep existing joins idempotent even in a full room.
• Bound debug room IDs, derive the 1024-chunk limit from named v1 size constants, remove unused ESLint tsconfigs, share join-result construction, and align event declarations/README with the implemented protocol and limits.

The security fixes are integrated without duplicating their membership checks or bypassing the chunk size/rate limits.

Dependency consolidation and ESLint migration

Source PR	Package	Resolved version in this PR
#7	diff	4.0.4
#12	eslint	10.10.0
#14	ajv	6.15.0
#16	minimatch (3.x)	3.1.5
#18	tar	7.5.22
#20	socket.io-parser	4.2.7
#21	flatted	3.4.4
#22	handlebars	4.7.9
#23	lodash-es	4.18.1
#24	lodash	4.18.1

Several resolved versions include newer compatible patches than the original PR targets. ESLint is intentionally upgraded to the current stable 10.10.0 rather than the older target in #12. Migrate to a shared flat config and typescript-eslint 8.70.0, adapt source typing and obsolete suppressions, and lint source/tests across all workspaces with zero warnings. Pin Yarn 4.14.1 and regenerate the existing lockfile format without copying the old Dependabot lockfile-format churn. No permanent resolution overrides are added.

Validation

• yarn install --immutable passes.
• yarn lint passes on ESLint 10.10.0, with zero warnings.
• yarn workspaces foreach --all --exclude @onekeyhq/monorepo run build passes.
• Cloud-sync tests: 15 passed. Mock-app tests: 6 passed.
• Transfer-server TypeScript build, real Socket.IO smoke suite (63 assertions), and crash-logging suite (8 assertions) pass. Coverage includes unauthorized injection through all relay paths, room-query privacy/rate limits, normal one-second polling, peer-join notification, stack removal, consecutive chunks, malformed/oversized chunks, and the 512 requests/second cap.
• The policy, real Socket.IO compatibility, and admission lifecycle suite passes 23 Node tests (including two parent tests). Coverage includes 9 MiB padding at every chunk envelope level, a valid 9 MiB legacy request, response flood/size disconnection, event/type mismatch, response IDs, mixed-direction budgets, metadata/UTF-8 accounting, query privacy/bursts, C2S/C2C ID isolation, room TTL, adapter failures, pending joins, disconnects, capacity, and idempotent rejoin.
• Re-ran 12 old/new App bridge combinations across polling, WebSocket, and upgrade transports against the updated relay; bidirectional legacy/chunk transfers and RPC interactions pass. Six Chrome cross-origin connection/room-creation checks pass with withCredentials both false and true. These use actual bridge source and synthetic data, not every historical app binary.
• Separately validated the companion App capability fallback with 23 Jest tests and 6 real TCP send-path scenarios, including a v5.18 receiver without getTransferType; genuine errors and cancellation do not silently fall back. The App fix and derived max-chunk constant are maintained in the App worktree, outside this server PR; the full App commit gate passes.
• git diff --check passes.

The full recursive dependency audit is not clean: it reports 62 entries across 23 packages (including deprecation notices). Every reported package/version was already present in the pre-consolidation lockfile; this PR does not resolve the repository's entire existing dependency backlog. Examples include engine.io 6.6.4, mongoose 8.17.1, and older minimatch 5.x/9.x paths. Install also retains existing third-party peer warnings.

Consolidates #7, #12, #14, #16, #18, #20, #21, #22, #23, #24, #26, and #27. The original PRs have been closed after consolidation, with references to this PR. This PR remains pending merge.

Related requirement: OK-63101. This PR is not a production deployment.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.70.0
	lodash@​4.17.21 ⏵ 4.18.1		+19	+1
	eslint-config-prettier@​8.10.2 ⏵ 10.1.8	+1		+29
	globals@​13.24.0 ⏵ 17.12.0			+1
	@​eslint/​js@​10.0.1
	eslint@​7.32.0 ⏵ 10.10.0	+1			+46

View full report

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-17T08:50:03.228702Z	f9edf38	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.