NEXT: remove native staged upload size caps and detect hidden ceilings

Merged
TE
7d ago
+387-10

Native staged chat uploads accept files and batches above 1 GiB, including manifests containing more than 64 files. This prevents a 65-file manifest from falling back to the legacy inline upload and its smaller limit. Nonnegative sizes, valid names, session checks, bounded transfer chunks, exact-length completion, cancellation and expiry remain. Chunk accounting avoids overflow at Int.max. Both native 1 GiB admission removals are retained, along with removal of an unused iOS image-size constant.

Request: “Attachments take arbitrarily large files of any type; there is no size cap.”

The lane-run attachment audit detects MAX_BYTES, MAX_SIZE and maximum…File/Bytes/Stage names, plus literal ceilings at or above 1 MiB compared with size, bytes, count, length or len. Exact path-and-symbol exceptions explain retained protocol/derived budgets and legacy paths awaiting streaming; they never exempt a whole file. This PR covers native staged admission. The remaining transport-dependent removals are tracked in #27016; no CI steps are added.

Validation at 951315e7ed67d8e0d81da763128d945c5a4c33c9:

  • All 13 guard tests pass, including the checked-in-tree scan: exact-tree fleet run 40774493507, snapshot a5bad8a432b1784715979be2e77c0f339385fbcb (identical tree to this head). Eight new MAX_*SIZE and count/length/len cases failed before this repair and pass after it.
  • AgentPaneUploadTests adds a manifest of 65 distinct files, each larger than 1 GiB, without allocating file contents. Existing regressions cover zero, Int.max, negative sizes and oversized transfer chunks. Exact-head fleet job 3ad2fed7de1592c376acc486 passed: all 5 AgentPaneUploadTests, 1 suite, exit 0, including the 65-file manifest regression.
  • Earlier native red/green evidence: before job 1fbd9e5f7421467464023f5a reproduced the >1 GiB decoder/writer refusals; after job a23f92a199b5423d1d32f120 passed AgentPaneUploadTests and AgentChatUploadsTests at 3813876bac5c678b16a1a3706ae139d7f358e726. These earlier receipts do not replace verification of this head.

Run the audit with python3 scripts/cmux-next/check-attachment-caps.py and its tests through cmux-ci test --setup none -- python3 tests/test_attachment_caps_guard.py.

No capture: this changes upload admission and source-audit checks, with no layout or styling changes.

No new timers; existing staging expiry and cancellation cleanup remain.

Review (codex gpt-6-astra high, independent review box): SHIP at 951315e7ed67d8e0d81da763128d945c5a4c33c9

The inherited Swift hold is removed per the 2026-10-29 landing directive. Current-head verification is recorded below; optional base reds remain subject to per-test comparison.

Agent session: agent session

2026-10-29 landing evidence

  • Exact head 99977d730445448d1c52b21fb09c87fe5721ab33: fleet step c32becc67f3e5c0e591ad980 passed AgentPaneUploadTests (exit 0).
  • Base 8b01895e95a37d8a691e3547d14180aa6fdf8fa8: coalesced fleet step b3afa706562d15b366162917 passed AgentPaneUploadTests; unrelated settings suites retained their existing base failures.
  • Exact-head independent Astra review is running for the final merge head; merge remains pinned to this SHA.

Agent session: agent session