Public Extract

An uploaded session export or patch/zip → text for the form.

Multipart form: kind (diff | agent_log) and file.

Only for an OPEN task (the token is the credential, as for submit). Nothing is stored: the page puts the text in the field, the candidate can read and edit it, and submit stores it exactly as a paste.

The form is parsed BY HAND, after the size and token checks: declaring File(...) / Form(...) params makes FastAPI spool the whole body (to disk past 1 MB, with no cap) before this function runs, so the 2 MB limit would only ever be checked after an attacker's gigabyte had been written. Content-Length is required (every browser FormData upload sends it) and the server never reads past it.