feat(copilot): add share_file tool + surface file share state to the agent

[TheodoreSpeaks]

Summary

• Add the sim-side share_file server tool handler: resolves a VFS path to the file, keeps the existing checks (org public-sharing policy, write/admin permission, ShareValidationError, and the FILE_SHARED/FILE_SHARE_DISABLED audit), then delegates to the shared upsertFileShare — same path the files UI uses
• Register it in the server tool router (+ generated catalog entries)
• Surface an ambient shared/shareAuthType flag on each file's metadata via one batched share lookup (no N+1), so the agent can see and grep what's shared — mirrors how workflows expose isDeployed

Pairs with

• Copilot: simstudioai/mothership#353 (tool definition + agent routing). That must merge first — mship-tools:check regenerates the catalog from the copilot repo's tool-catalog-v1.json, so this PR's check stays red until fix(deps): bump the dependencies group in /apps/sim with 4 updates #353 lands.

Type of Change

• New feature

Testing

• tsc --noEmit 0 errors; bun run lint:check and check:api-validation:strict pass; biome clean

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Companion: simstudioai/mothership#353

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 20, 2026 5:53pm

[cursor]

PR Summary

Medium Risk
Touches public file sharing and access-control validation; the effectiveAuthType fix is security-relevant, while the new tool reuses existing share paths with write permission gates.

Overview
Adds a share_file copilot server tool so the agent can share or unshare workspace files by VFS path, using the same upsertFileShare flow as the files UI (write access, org sharing policy, validation, audit).

API hardening: When re-enabling a share without passing authType, the workspace file share PUT route now validates against the effective auth mode (authType ?? existingShare?.authType ?? 'public') instead of assuming public, so a restricted share cannot be reactivated after policy changes.

Agent visibility: Workspace VFS file metadata gains batched shared, shareAuthType, and shareUrl (soft-fail if share lookup errors). Generated tool catalog/schemas, router registration, and UI titles for share/unshare are included.

^{Reviewed by Cursor Bugbot for commit 2b09aff. Bugbot is set up for automated code reviews on this repo. Configure here.}

[TheodoreSpeaks]

@greptile review

[greptile-apps]

Greptile Summary

This PR adds Copilot support for sharing workspace files. The main changes are:

• Adds the share_file server tool and router registration.
• Adds generated catalog and runtime schema entries for the new tool.
• Reuses the existing file-share policy checks and share upsert path.
• Adds shared-state fields to file metadata in the workspace VFS.
• Adds a soft fallback when share metadata lookup fails.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/server/files/share-file.ts	Adds the Copilot share_file handler with workspace access checks, share policy validation, share upsert handling, and audit logging.
apps/sim/app/api/workspaces/[id]/files/[fileId]/share/route.ts	Updates file-share validation to check the auth type that will be persisted when a share is enabled.
apps/sim/lib/copilot/vfs/workspace-vfs.ts	Adds batched share-state lookup for file metadata with a local fallback when that lookup fails.
apps/sim/lib/copilot/vfs/serializers.ts	Extends serialized file metadata with share state, auth type, and share URL fields.
apps/sim/lib/copilot/tools/server/router.ts	Registers share_file as a write-capable server tool.
apps/sim/lib/copilot/generated/tool-catalog-v1.ts	Adds the generated catalog entry for share_file.
apps/sim/lib/copilot/generated/tool-schemas-v1.ts	Adds the generated runtime schema for share_file.
apps/sim/lib/copilot/tools/tool-display.ts	Adds display text for share and unshare tool runs.

_{Reviews (8): Last reviewed commit: "feat(copilot): add share_file tool handl..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR adds Copilot support for sharing workspace files. The main changes are:

• New share_file server tool and router registration.
• Generated tool catalog and runtime schema entries.
• File VFS metadata now includes shared and shareAuthType.
• Workspace file materialization now batches share-state lookups.

Confidence Score: 4/5

The share tool and VFS enrichment paths need fixes before merging.

• Re-sharing without authType can reactivate an old share mode after validating a different one.
• A share-state lookup failure can make the Copilot VFS return no files.
• The generated catalog and router wiring otherwise match the new tool shape.

apps/sim/lib/copilot/tools/server/files/share-file.ts; apps/sim/lib/copilot/vfs/workspace-vfs.ts

Security Review

The new share tool can reactivate an existing non-public share mode after validating the request as public when authType is omitted.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/server/files/share-file.ts	Adds the new share/unshare server tool; the omitted-auth path can validate a different share mode than the one that is reactivated.
apps/sim/lib/copilot/tools/server/router.ts	Registers share_file as a write-capable server tool.
apps/sim/lib/copilot/generated/tool-catalog-v1.ts	Adds the generated catalog entry for the new Copilot file-sharing tool.
apps/sim/lib/copilot/generated/tool-schemas-v1.ts	Adds the generated runtime parameter and result schema for share_file.
apps/sim/lib/copilot/vfs/serializers.ts	Adds optional share-state fields to serialized file metadata.
apps/sim/lib/copilot/vfs/workspace-vfs.ts	Adds batched share-state enrichment during file materialization; the new lookup can currently hide all files if it fails.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Agent as Copilot agent
participant Router as Server tool router
participant Tool as share_file tool
participant Policy as Share policy check
participant Shares as Share manager
participant VFS as Workspace VFS
Agent->>Router: share_file(path, action, authType?)
Router->>Tool: execute with workspace context
Tool->>Policy: validate requested share mode
Tool->>Shares: create, update, or disable file share
Shares-->>Tool: share state
Tool-->>Agent: success message and share data
VFS->>Shares: batch lookup file share states
Shares-->>VFS: share map by file id
VFS-->>Agent: file metadata with shared/shareAuthType

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Agent as Copilot agent
participant Router as Server tool router
participant Tool as share_file tool
participant Policy as Share policy check
participant Shares as Share manager
participant VFS as Workspace VFS
Agent->>Router: share_file(path, action, authType?)
Router->>Tool: execute with workspace context
Tool->>Policy: validate requested share mode
Tool->>Shares: create, update, or disable file share
Shares-->>Tool: share state
Tool-->>Agent: success message and share data
VFS->>Shares: batch lookup file share states
Shares-->>VFS: share map by file id
VFS-->>Agent: file metadata with shared/shareAuthType

Loading

_{Reviews (1): Last reviewed commit: "feat(copilot): add share_file tool handl..." | Re-trigger Greptile}

[github-actions]

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

• ❌ simstudioai/mothership#353 — OPEN, not merged (targets staging) — feat(file-agent): add share_file tool and route file-sharing to the file agent

[TheodoreSpeaks]

@greptile review

Addressed the auth-type validation finding: share_file (and the share PUT route) now resolve the effective authType (authType ?? existingShare.authType ?? 'public') before calling validatePublicFileSharing, so a bare re-enable can no longer reactivate a now-disallowed password/email/sso share.

[TheodoreSpeaks]

@greptile review

Addressed both findings:

1. Auth-type bypass (P1) — share_file and the share PUT route now validate the effective authType (authType ?? existingShare.authType ?? 'public') before validatePublicFileSharing, so a bare re-enable can't reactivate a now-disallowed password/email/sso share.
2. Share lookup hides files (P1) — the getSharesForResources enrichment in workspace-vfs.ts now fails soft (its own try/catch → empty share map), so a transient share-query failure degrades to shared: false instead of dropping the whole file tree.

[TheodoreSpeaks]

@greptile review

Added shareUrl to file metadata (alongside shared/shareAuthType) so the agent can read an already-shared file's public link directly, without re-sharing. Sourced from the same batched getSharesForResources lookup — no extra query; only present when shared is true.

[TheodoreSpeaks]

@greptile review

Rebased onto latest staging and resolved conflicts (staging's rename_file→mv / folder-tool refactor). Regenerated the tool catalog from the rebased copilot branch; kept staging's updatedAt field alongside the share metadata. No logic changes.

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2b09aff. Configure here.}