[writingdeveloper]

The person asked to send any file to a remote session, and to relax the size limit.

Before: images, plus 21 document kinds (text, data, logs, PDF) up to 5 MB each, sent in a single link message (frame limit 8 MB).

Now: any kind, up to 4 GB, sent in 2 MB pieces.

• Host methods: cockpit:uploadStart(name, size), uploadChunk(id, offset, base64), uploadFinish(id) → path, uploadAbort(id). All need control, like receiveFile.
• The link allows uploadChunk 120 s.
• receiveFile is kept for senders older than this. Against an older host, the sender falls back to it: same kinds, 5 MB.

Why the kind check is dropped: sending a file needs the same permission as typing into the host's sessions. A device with that permission can already ask the agent to run anything, so refusing an .exe in temp protected nothing.

What the receiving PC still enforces (src/main/fileUploads.ts):

• The file is written only into tmpdir() as devdeck-file-<uuid>-<safe name>. The temp sweeper already removes those after a day. While the upload runs it is a .part file, renamed when the last byte is in.
• DevDeck never opens or runs the file.
• On Windows it gets a Zone.Identifier with ZoneId=3 (Mark of the Web).
• A file is refused if it would leave less than 2 GB free. Bytes that open uploads have not written yet count against that.
• At most 4 uploads are open. An upload idle for 5 minutes is dropped and its part file deleted.
• A piece out of order, larger than 2 MB, or past the announced size ends the upload.

Sender:

• Reads one piece at a time with File.slice.
• Shows a progress toast for files over 8 MB.
• An image that cannot be redrawn as PNG within 5 MB now goes as the original file instead of being refused.
• The 📎 picker no longer filters by kind, and its tooltip says "any kind, up to 4 GB".

Also: a What's new entry (send-any-file) in all 4 languages; release notes; README; docs/quality.md.

Checks:

• vitest: 1526 passed.
  • New fileUploads.test.ts covers order, size, disk space, open-upload limit, missing bytes, abort, and on Windows the Mark of the Web.
  • New sender tests cover splitting, progress, empty files, a refused piece, and telling an older host apart from a full disk.
  • The surface test checks the control gate.
• tsc clean.
• qa:images-remote: a 9 MB .bin crosses two real paired DevDecks over TLS, byte-identical, with the progress toast shown. The existing image, log and refusal checks still pass.
• qa:cockpit-tools and qa:images pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_016NLGwiBY5uEivJqERQzcoY