fix(file): bun issues with new file creation

[icecrasher321]

Summary

JS core error on file type assertion

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 14, 2026 5:39pm

[cursor]

PR Summary

Medium Risk
Touches file-upload API routes and filename sanitization; behavior changes can impact clients and storage keys, but the changes are narrowly scoped to validation and type-guarding.

Overview
Fixes Bun/runtime issues in upload endpoints by type-guarding FormData inputs: /api/files/upload now filters formData.getAll('file') to actual File instances, and /api/workspaces/[id]/files validates that formData.get('file') is a File before proceeding.

Adds explicit checks for missing File.name (returning 400 / throwing InvalidRequestError) and updates sanitizeFileName to accept string | null | undefined, defaulting to 'untitled' to avoid crashes when callers pass nullish names.

^{Written by Cursor Bugbot for commit 22fca37. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes a Bun runtime incompatibility where type-casting formData.getAll('file') as File[] and formData.get('file') as File would bypass runtime type validation, causing JS core errors when Bun returns non-File form data entries. The fix replaces the unsafe casts with proper instanceof File guards across the two file upload routes and adds a defensive null-check in sanitizeFileName.

Key changes:

• files/upload/route.ts: getAll('file') result is now filtered via instanceof File instead of blindly cast; empty-string file name check added in the per-file loop.
• workspaces/[id]/files/route.ts: get('file') result is verified with instanceof File before use; fileName extracted and validated separately.
• executor/constants.ts: sanitizeFileName gains a falsy/non-string guard returning 'untitled' for edge inputs.

Minor issues found:

• All three files include a typeof x !== 'string' check that is unreachable after an instanceof File assertion (since File.name is always a string). The checks are harmless but are dead code.
• sanitizeFileName's TypeScript parameter type (string) contradicts the runtime guard; widening it to string | null | undefined would make the guard useful at the type level and prevent callers from needing unsafe casts.

Confidence Score: 4/5

• Safe to merge — the core fix is correct and improves robustness under Bun; only minor style improvements remain.
• The instanceof File guards correctly replace the unsafe type casts and directly address the stated Bun runtime error. The only concerns are redundant typeof checks (dead code, not bugs) and a TypeScript signature mismatch in sanitizeFileName that doesn't affect runtime behavior.
• No files require special attention; the suggestions are all non-critical style improvements.

Important Files Changed

Filename	Overview
apps/sim/app/api/files/upload/route.ts	Replaced unsafe as File[] cast with a proper instanceof File filter guard to fix Bun runtime incompatibility; adds a redundant typeof name check that can be simplified.
apps/sim/app/api/workspaces/[id]/files/route.ts	Replaced unsafe as File cast with instanceof File check; adds a redundant typeof name check similar to the upload route.
apps/sim/executor/constants.ts	Adds a defensive null/non-string guard to sanitizeFileName, but the function signature still declares string which contradicts the broader guard intent.

Sequence Diagram

sequenceDiagram
participant Client
participant UploadRoute as /api/files/upload
participant WorkspaceRoute as /api/workspaces/[id]/files
participant Storage
Client->>UploadRoute: POST multipart/form-data (file)
UploadRoute->>UploadRoute: formData.getAll('file')
UploadRoute->>UploadRoute: filter(f => f instanceof File) [NEW]
alt No File instances remain
UploadRoute-->>Client: 400 No files provided
else Valid File(s) present
UploadRoute->>UploadRoute: check file.name non-empty [NEW]
UploadRoute->>UploadRoute: validateFileExtension(name)
UploadRoute->>Storage: upload buffer
UploadRoute-->>Client: 200 upload result
end
Client->>WorkspaceRoute: POST multipart/form-data (file)
WorkspaceRoute->>WorkspaceRoute: formData.get('file')
WorkspaceRoute->>WorkspaceRoute: instanceof File check [NEW]
alt Not a File instance
WorkspaceRoute-->>Client: 400 No file provided
else Valid File
WorkspaceRoute->>WorkspaceRoute: check fileName non-empty [NEW]
WorkspaceRoute->>WorkspaceRoute: check size ≤ 100MB
WorkspaceRoute->>Storage: uploadWorkspaceFile(buffer)
WorkspaceRoute-->>Client: 200 success
end

Loading

_{Last reviewed commit: f706eb5}

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR