fix(files): refuse unrendered bytes at the download boundary

Addresses the second review round.

- Throw UnrenderableDocumentError from downloadServableFileFromStorage instead
  of returning bytes with an `unrendered` flag. Around 45 call sites (email
  attachments, cloud uploads, zip entries, provider attachments) receive only a
  Buffer and re-infer the type from the filename, so a flag they must remember
  to check is a flag they will not check. Those callers already handled the
  previous not-ready throw, so failing is the shape they expect. The file-serve
  route is unaffected — it resolves bytes directly and keeps the graceful
  passthrough, where a human downloading the file has a use for it.
- Surface that failure through hydration: with throwOnDocNotReady set, the
  caller cannot use a file with no content, so an unrenderable document now
  reaches it verbatim instead of degrading to null and reporting a misleading
  "may exceed size limit or no longer accessible".
- Stop a shared render inheriting one caller's cancellation. The coalesced run
  no longer carries any caller's signal; each caller races its own instead, so
  an aborting reader gives up promptly while the render finishes for the others
  and still lands in the cache.

Author: j15z

apps/sim/lib/copilot/tools/server/files/doc-compile.ts

@@ -512,6 +512,19 @@ const unrenderableSources = new Set<string>()
  */
 const inFlightRenders = new Map<string, Promise<{ buffer: Buffer; contentType: string }>>()
 
+/** Rejects when `signal` aborts, so a caller can abandon a shared render without cancelling it. */
+function rejectOnAbort(signal: AbortSignal): Promise<never> {
+  return new Promise((_resolve, reject) => {
+    if (signal.aborted) {
+      reject(signal.reason ?? new Error('Aborted'))
+      return
+    }
+    signal.addEventListener('abort', () => reject(signal.reason ?? new Error('Aborted')), {
+      once: true,
+    })
+  })
+}
+
 function coalesceRender(
   key: string,
   run: () => Promise<{ buffer: Buffer; contentType: string }>
@@ -667,15 +680,22 @@ export async function resolveServableDocBytes(args: {
   }
 
   try {
-    return await coalesceRender(renderKey, async () => {
+    // The shared run deliberately carries no caller's signal: it is one piece of
+    // work several readers are waiting on, so letting whoever happened to start it
+    // cancel it would reject every other waiter with an AbortError they did not
+    // ask for. Each caller instead races its own signal, so an aborting reader
+    // gives up promptly while the render continues for the rest and still lands in
+    // the cache.
+    const shared = coalesceRender(renderKey, async () => {
       const compiled = await runSandboxTask(
         format.taskId,
         { code: source, workspaceId: workspaceId || '' },
-        { ownerKey, signal }
+        { ownerKey }
       )
       compiledCacheSet(renderKey, compiled)
       return { buffer: compiled, contentType: format.contentType }
     })
+    return await (signal ? Promise.race([shared, rejectOnAbort(signal)]) : shared)
   } catch (error) {
     // Unlike the E2B engine, the isolated-vm task does not distinguish a script
     // error from an infra one, so the only signal available here is cancellation —

apps/sim/lib/execution/payloads/materialization.server.ts

@@ -315,19 +315,6 @@ export async function readUserFileContent(
   if (!servable) {
     throw new Error(`File content for ${file.name} is unavailable.`)
   }
-  if (servable.unrendered) {
-    // The resolver could not produce the document these bytes claim to be and is
-    // serving them under a generic type. Every consumer here feeds the result to
-    // something that expects the real document — a provider attachment, a document
-    // parser, a function-block read — and this function returns only a string, so
-    // the honest content type cannot travel with it. Relabelling the source as a
-    // PDF downstream is the corruption this module exists to prevent, so refuse.
-    // (The file-serve route keeps the graceful passthrough: a human downloading
-    // the bytes and seeing what they actually are is useful.)
-    throw new Error(
-      `File ${file.name} could not be rendered; its stored bytes are not the format its name claims.`
-    )
-  }
   const { buffer } = servable
   if (buffer.length > maxSourceBytes) {
     throw new ExecutionResourceLimitError({

apps/sim/lib/uploads/utils/file-utils.server.test.ts

@@ -163,6 +163,30 @@ describe('downloadServableFileFromStorage generated-doc gating', () => {
     )
   })
 
+  it('refuses unrendered bytes rather than handing them to a caller that expects the document', async () => {
+    // ~45 call sites (email attachments, cloud uploads, zip entries, provider
+    // attachments) receive only a Buffer and re-infer the type from the filename, so
+    // an opt-in flag would be silently ignored by all of them. Failing here is what
+    // keeps generation source from going out under a .pdf.
+    mockResolveServableDocBytes.mockResolvedValue({
+      buffer: Buffer.from('<html>not a pdf</html>'),
+      contentType: 'application/octet-stream',
+      unrendered: true,
+    })
+    const userFile: UserFile = {
+      id: 'f7',
+      name: 'report.pdf',
+      url: '',
+      size: 5,
+      type: 'text/x-python-pdf',
+      key: 'workspace/ws-1/1700000000000-abc1234-report.pdf',
+    }
+
+    await expect(
+      downloadServableFileFromStorage(userFile, 'req-1', createLogger('test'))
+    ).rejects.toThrow(/could not be rendered/)
+  })
+
   it('does not mistake the generic octet-stream fallback for a real declared type', async () => {
     // convertToUserFile emits application/octet-stream for a type-less input, so this
     // value carries no information about whether the bytes are generation source.

apps/sim/lib/uploads/utils/file-utils.server.ts

@@ -349,13 +349,38 @@ export interface ServableFile {
   contentType: string
   /**
    * Set when the bytes could not be rendered and are being served as-is under a
-   * generic content type. The bytes are NOT the document the filename claims, so a
-   * consumer that hands them to something expecting that format (a provider
-   * attachment, a document parser) must refuse rather than relabel them.
+   * generic content type. The bytes are NOT the document the filename claims.
+   * {@link downloadServableFileFromStorage} refuses these rather than returning
+   * them — see {@link UnrenderableDocumentError}.
    */
   unrendered?: boolean
 }
 
+/**
+ * Thrown when a file's stored bytes are not the format its name claims and could
+ * not be rendered into it.
+ *
+ * Every caller of {@link downloadServableFileFromStorage} hands the bytes to
+ * something that expects the real document — an email attachment, a cloud upload,
+ * a zip entry, a provider attachment — and none of them can tell a rendered
+ * artifact from raw generation source once it is just a Buffer. Returning the
+ * bytes with an honest content type would still be wrong, because the filename
+ * travels separately and downstream re-infers the type from it. Failing here is
+ * the only place that reliably prevents source text going out under a `.pdf`.
+ *
+ * The file-serve route deliberately does NOT go through this helper: it resolves
+ * bytes directly and keeps the graceful passthrough, because a human downloading
+ * the file and seeing what it actually is has a use for it.
+ */
+export class UnrenderableDocumentError extends Error {
+  constructor(fileName: string) {
+    super(
+      `File ${fileName} could not be rendered; its stored bytes are not the format its name claims.`
+    )
+    this.name = 'UnrenderableDocumentError'
+  }
+}
+
 /**
  * Downloads a workspace file and resolves it to its SERVABLE bytes — the variant
  * every tool that hands a file to an external service (email attachments, chat
@@ -420,6 +445,10 @@ export async function downloadServableFileFromStorage(
     signal: options.signal,
   })
 
+  if (resolved.unrendered) {
+    throw new UnrenderableDocumentError(userFile.name)
+  }
+
   // Re-check: the raw download enforced maxBytes on the source, but a generated doc
   // resolves to a larger artifact.
   if (options.maxBytes !== undefined && resolved.buffer.length > options.maxBytes) {

apps/sim/lib/uploads/utils/user-file-base64.server.test.ts

@@ -47,6 +47,15 @@ const RENDERED_PDF_BUFFER = Buffer.from('%PDF-1.4 rendered', 'utf8')
 
 vi.mock('@/lib/uploads/utils/file-utils.server', () => ({
   downloadFileFromStorage: mockDownloadFile,
+  // Mirrors the real module: resolveBase64 narrows on this class to decide whether a
+  // strict caller sees the failure, so omitting it from the mock would break that
+  // check rather than exercise it.
+  UnrenderableDocumentError: class UnrenderableDocumentError extends Error {
+    constructor(fileName: string) {
+      super(`File ${fileName} could not be rendered`)
+      this.name = 'UnrenderableDocumentError'
+    }
+  },
   downloadServableFileFromStorage: async (
     file: UserFile,
     requestId: string,

apps/sim/lib/uploads/utils/user-file-base64.server.ts

@@ -443,12 +443,21 @@ async function resolveBase64(
     // already-finished result opt out, so a late compile cannot retroactively
     // fail completed work.
     if (options.throwOnDocNotReady) {
+      // This caller cannot use a file without content, so any reason the bytes are
+      // missing must reach it verbatim. Degrading to null here is what produced the
+      // misleading "may exceed size limit or no longer accessible" message for a
+      // document that was actually still compiling, or one whose stored bytes are
+      // not the format its name claims.
+      //
       // Imported lazily: `servable-file-response` pulls in the doc-compile module
       // graph (remote sandbox, sandbox task runner, execution limits), and a static
       // import here would load all of it for every hydration consumer — mirroring
       // the deliberate dynamic import in file-utils.server.ts.
-      const { isDocNotReadyError } = await import('@/lib/uploads/utils/servable-file-response')
-      if (isDocNotReadyError(error)) {
+      const [{ isDocNotReadyError }, { UnrenderableDocumentError }] = await Promise.all([
+        import('@/lib/uploads/utils/servable-file-response'),
+        import('@/lib/uploads/utils/file-utils.server'),
+      ])
+      if (isDocNotReadyError(error) || error instanceof UnrenderableDocumentError) {
         throw error
       }
     }