NEXT: Cloud and peer chat uploads take files of any size

Closed
TE
5d ago
+1356-361

Leo: "WHY THE F*** SHOULD THERE BE A F***ING SIZE CAP ANYWAYS ... I ALREADY SAID WE NEED ARBITARRILY LARGE FILES OF ANY TYPE" (2026-10-26).

Cloud and peer chat uploads accept arbitrary file sizes while keeping transfer memory bounded by chunks. This is a dependency of #26958 for attachment originals. Related admission work: #27016 and #26409. The local-chat stager remains outside this PR.

Behavior

  • Remove Cloud/peer native admission caps, the staged-request decoder's file/count caps, and the Cloud upload CLI's 1 GiB cap. Preserve valid names, nonnegative sizes, ordered manifest authorization, session/target binding, and 512 KiB staging chunks.
  • Stream staged peer files from disk and emit Cloud CLI progress after each remote write. Active uploads use bounded per-request or idle deadlines, with no fixed total transfer deadline.
  • Keep stages cancellable through remote finish and awaited terminal cleanup. Page removal reaches a pending finish; fresh-task peer cancellation and scoped Cloud upload-cancel remove transfer-owned state. Batch authorization remains owned during staging and finish, so a slow first file cannot expire permission for the next file.
  • Stop stage/batch timers, abort listeners, and subscriptions on their terminal paths. File cleanup is awaited on the file-work lane before cancellation returns.
  • Bound upload and upload-cancel stdout AND stderr capture to a 4 MiB tail before allocating returned output. The final JSON reply survives without materializing old heartbeat history. Other ProcessRunner callers retain their complete-output defaults.

Memory and scope

The staged path uses bounded chunks and disk-backed stages. Legacy inline fallback remains page-bounded at 24 MiB. Upload reply/diagnostic capture is bounded independently of file size and transfer duration; an oversized final JSON line fails existing reply parsing.

Anonymous output files still spool stdout/stderr during child execution and can grow with transfer duration. This repair bounds completion capture memory; it does not claim bounded temporary disk usage. No daemon behavior or feature defaults change.

This diff keeps the admission, progress, authorization, cancellation, and cleanup state machine together with its regressions because those paths jointly determine whether arbitrary uploads finish safely. The obsolete limit-specific localized string is removed; existing translated upload-failure text is reused.

Exact source verdict

Independent Astra high whole-diff static review: SHIP at 53c2aa1bf4a8ca61abc4f8f051a271cf5a17d4ee, tree 04c95c24627ce1bf3cfe4828a8232dc3fcddc022, against base 5eaa384b5266504fb36a013c79f131ca0bd5f1c9.

This is a source-only verdict. It does not establish native compilation, native runtime correctness, green required checks, or permission to merge while the native HOLD remains.

Observed validation

  • Final-head Swift syntax parsing and pre-push checks pass. Parsing is not typechecking or native execution.
  • Web timeout regression red: run 40877856149, predecessor 211f09 plus the regression, expected final path but received the old elapsed timeout.
  • Web green: run 40878361783, tree matching predecessor 280240: 22 tests, 427 assertions, full format/lint/typecheck passed. Web sources are unchanged at the final head; this is reused unchanged-source evidence, not final-tree native proof.
  • Rust upload tests, binary build, and process-cancellation proof: run 40873830359, predecessor 7db0550: sparse 1 GiB+1 admission and scoped cancellation/sibling isolation pass. A real CLI process is killed after its first 8 MiB write; scoped cancellation removes its partial transfer. The endpoint models remote filesystem state in a controlled map, not a live Cloud VM. Rust/proof sources are unchanged at the final head.
  • Earlier throttled transfer: run 40822935120, predecessor 4dc1c25: 1 GiB+1, 129 chunks/heartbeats, 130.77 seconds, passed. Reused evidence for unchanged transfer sources; it does not validate subsequent Swift lifecycle repairs.

Native UNEXECUTED / remaining work

Under #26809 HOLD, final native typecheck, compilation, app launch, and execution of the new Swift regressions remain UNEXECUTED. Added coverage includes cancellation from an already-cancelled task; >10-minute staging plus finish followed by the next batch begin; virtual progress beyond one hour, stall/cancel watchdog cleanup and preserved hard deadlines; many-heartbeat final-reply retention, sparse output over 1 GiB, bounded stdout/stderr, and unchanged complete-output defaults. Existing sparse 1 GiB+1 and Int.max cases remain.

After the named hold is released, the final-loop owner reconciles required checks and runs the necessary focused native suites before merging. No SHIP claim is transferred to another head.

No visual behavior changes; no screenshot capture applies.

Changelog

  • Fixed: Cloud and peer chat attachments accept files of any size with progress-aware transfer deadlines and cancellable cleanup.

Agent session: agent session