1 files changed, 19 insertions, 0 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index d2ec1de..ba8a3e4 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -4039,6 +4039,25 @@ class WebRTCPeerSession:
         if not entry:
             self._send({"type": "error", "detail": "File not found"})
             return
+
+        # The gate `BROWSER_INCOMPATIBLE_AUDIO_EXTS` exists for, applied where it
+        # costs something. Nothing on the node read it: the player asks for these
+        # two extensions and no others, and `music-player.js` described itself as
+        # "kept in sync with the node's" constant — so the whole restriction lived
+        # in the caller, and a member's own message is not the caller.
+        #
+        # What that let through: this converts a *whole file* and holds a
+        # transcode slot shared with video streaming while it runs. Pointed at a
+        # two-hour film it spends minutes of the operator's CPU and a slot every
+        # other viewer is queued behind. `AUDIO_TRANSCODE_MAX_BYTES` catches the
+        # result, after the work; only this catches the work.
+        if Path(entry.name).suffix.lower() not in BROWSER_INCOMPATIBLE_AUDIO_EXTS:
+            self._send({
+                "type": "error",
+                "detail": "This file does not need transcoding — play it directly.",
+                "code": "transcode_not_applicable",
+            })
+            return
         file_path, refusal = await off_disk(ctx["roots"], _locate, ctx["roots"], entry)
         if refusal is not None:
             self._send({"type": "error", "detail": refusal})