fix(files): serve rendered documents instead of source code

apps/sim/lib/copilot/tools/server/files/doc-compile.ts

@@ -541,8 +541,9 @@ export async function resolveServableDocBytes(args: {
  }
  }
 
- // Reaches here only for xlsx, which has no isolated-vm fallback.
- if (!format) return { buffer: rawBuffer, contentType: getContentType(fileName) }
+ // Reaches here only for xlsx, which has no isolated-vm fallback. Returning these
+ // bytes would expose generation source as a spreadsheet.
+ if (!format) throw new DocCompileUserError('Document is still being generated')
 
  const cacheKey = sha256Hex(`${ext}${source}${workspaceId ?? ''}`)
  const cached = compiledDocCache.get(cacheKey)

apps/sim/lib/copilot/tools/server/files/doc-servable.test.ts

@@ -158,14 +158,30 @@ describe('resolveServableDocBytes', () => {
  expect(mockRunSandboxTask).not.toHaveBeenCalled()
  })
 
- it('returns raw XLSX source when there is no workspaceId (xlsx has no isolated-vm path)', async () => {
- const result = await resolveServableDocBytes({
- rawBuffer: XLSX_SOURCE,
- fileName: 'sheet.xlsx',
- workspaceId: undefined,
- })
+ it('throws instead of returning XLSX source when E2B is disabled', async () => {
+ mockLoadCompiledDoc.mockResolvedValue(null)
+ setEnvFlags({ isDocSandboxEnabled: false })
+
+ await expect(
+ resolveServableDocBytes({
+ rawBuffer: XLSX_SOURCE,
+ fileName: 'sheet.xlsx',
+ workspaceId: WORKSPACE_ID,
+ })
+ ).rejects.toBeInstanceOf(DocCompileUserError)
+
+ expect(mockRunSandboxTask).not.toHaveBeenCalled()
+ })
+
+ it('throws instead of returning XLSX source when there is no workspaceId', async () => {
+ await expect(
+ resolveServableDocBytes({
+ rawBuffer: XLSX_SOURCE,
+ fileName: 'sheet.xlsx',
+ workspaceId: undefined,
+ })
+ ).rejects.toBeInstanceOf(DocCompileUserError)
 
- expect(result.buffer).toBe(XLSX_SOURCE)
  expect(mockLoadCompiledDoc).not.toHaveBeenCalled()
  expect(mockRunSandboxTask).not.toHaveBeenCalled()
  })

apps/sim/lib/execution/payloads/materialization.server.test.ts

@@ -0,0 +1,56 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockDownloadServableFileFromStorage, mockVerifyFileAccess } = vi.hoisted(() => ({
+ mockDownloadServableFileFromStorage: vi.fn(),
+ mockVerifyFileAccess: vi.fn(),
+}))
+
+vi.mock('@/lib/uploads/utils/file-utils.server', () => ({
+ downloadServableFileFromStorage: mockDownloadServableFileFromStorage,
+}))
+
+vi.mock('@/app/api/files/authorization', () => ({
+ verifyFileAccess: mockVerifyFileAccess,
+}))
+
+import { readUserFileContent } from '@/lib/execution/payloads/materialization.server'
+import type { UserFile } from '@/executor/types'
+
+const PDF_SOURCE = Buffer.from('from reportlab.pdfgen import canvas')
+const PDF_BYTES = Buffer.from('%PDF-1.4 rendered bytes')
+
+const generatedPdf: UserFile = {
+ id: 'file-1',
+ name: 'report.pdf',
+ url: '',
+ size: PDF_SOURCE.length,
+ type: 'text/x-python-pdf',
+ key: 'workspace/2f1d8c3e-5b6a-4c7d-8e9f-0a1b2c3d4e5f/1700000000000-abc1234-report.pdf',
+}
+
+describe('readUserFileContent', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ generatedPdf.size = PDF_SOURCE.length
+ mockVerifyFileAccess.mockResolvedValue(true)
+ mockDownloadServableFileFromStorage.mockResolvedValue({
+ buffer: PDF_BYTES,
+ contentType: 'application/pdf',
+ })
+ })
+
+ it('returns the compiled artifact instead of the stored generation source', async () => {
+ const content = await readUserFileContent(generatedPdf, {
+ userId: 'user-1',
+ encoding: 'base64',
+ })
+
+ expect(mockDownloadServableFileFromStorage).toHaveBeenCalledOnce()
+ expect(content).toBe(PDF_BYTES.toString('base64'))
+ expect(content).not.toBe(PDF_SOURCE.toString('base64'))
+ expect(generatedPdf.size).toBe(PDF_BYTES.length)
+ })
+})

apps/sim/lib/execution/payloads/materialization.server.ts

@@ -10,8 +10,12 @@ import {
 } from '@/lib/execution/payloads/large-value-ref'
 import { ExecutionResourceLimitError } from '@/lib/execution/resource-errors'
 import type { StorageContext } from '@/lib/uploads'
-import { bufferToBase64, inferContextFromKey } from '@/lib/uploads/utils/file-utils'
-import { downloadFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import {
+ bufferToBase64,
+ inferContextFromKey,
+ isGeneratedDocumentSourceType,
+} from '@/lib/uploads/utils/file-utils'
+import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
 import type { UserFile } from '@/executor/types'
 
 const logger = createLogger('ExecutionPayloadMaterialization')
@@ -267,6 +271,11 @@ export async function assertUserFileContentAccess(
  }
 }
 
+/**
+ * Reads the bytes a consumer should receive. For generated documents, updates the
+ * file's size to the rendered artifact size so downstream attachment routing does
+ * not make decisions from the smaller generation-source size.
+ */
 export async function readUserFileContent(
  file: unknown,
  options: ReadUserFileContentOptions
@@ -291,9 +300,14 @@ export async function readUserFileContent(
  const requestId = options.requestId ?? 'unknown'
 
  try {
- buffer = await downloadFileFromStorage(file, requestId, log, { maxBytes: maxSourceBytes })
+ buffer = (
+ await downloadServableFileFromStorage(file, requestId, log, { maxBytes: maxSourceBytes })
+ ).buffer
  } catch (error) {
  if (isPayloadSizeLimitError(error)) {
+ if (isGeneratedDocumentSourceType(file.type) && error.observedBytes !== undefined) {
+ file.size = error.observedBytes
+ }
  throw new ExecutionResourceLimitError({
  resource: 'execution_payload_bytes',
  attemptedBytes: error.observedBytes ?? maxSourceBytes + 1,
@@ -306,6 +320,9 @@ export async function readUserFileContent(
  if (!buffer) {
  throw new Error(`File content for ${file.name} is unavailable.`)
  }
+ if (isGeneratedDocumentSourceType(file.type)) {
+ file.size = buffer.length
+ }
  if (buffer.length > maxSourceBytes) {
  throw new ExecutionResourceLimitError({
  resource: 'execution_payload_bytes',

apps/sim/lib/uploads/utils/file-utils.server.test.ts

@@ -3,27 +3,51 @@
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockDownloadFile } = vi.hoisted(() => ({
- mockDownloadFile: vi.fn(),
-}))
+const { mockDownloadFile, mockParseWorkspaceFileKey, mockResolveServableDocBytes } = vi.hoisted(
+ () => ({
+ mockDownloadFile: vi.fn(),
+ mockParseWorkspaceFileKey: vi.fn(),
+ mockResolveServableDocBytes: vi.fn(),
+ })
+)
 
 vi.mock('@/lib/uploads/core/storage-service', () => ({
  downloadFile: mockDownloadFile,
  hasCloudStorage: vi.fn(() => true),
 }))
 
+vi.mock('@/lib/uploads/contexts/execution/execution-file-manager', () => ({
+ downloadExecutionFile: mockDownloadFile,
+}))
+
+vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
+ parseWorkspaceFileKey: mockParseWorkspaceFileKey,
+}))
+
+vi.mock('@/lib/copilot/tools/server/files/doc-compile', () => ({
+ resolveServableDocBytes: mockResolveServableDocBytes,
+}))
+
 vi.mock('@/app/api/files/authorization', () => ({
  verifyFileAccess: vi.fn(),
 }))
 
 import { createLogger } from '@sim/logger'
-import { downloadFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import {
+ downloadFileFromStorage,
+ downloadServableFileFromStorage,
+} from '@/lib/uploads/utils/file-utils.server'
 import type { UserFile } from '@/executor/types'
 
 describe('downloadFileFromStorage context derivation', () => {
  beforeEach(() => {
  vi.clearAllMocks()
  mockDownloadFile.mockResolvedValue(Buffer.from('bytes'))
+ mockParseWorkspaceFileKey.mockReturnValue(null)
+ mockResolveServableDocBytes.mockImplementation(async ({ rawBuffer }) => ({
+ buffer: rawBuffer,
+ contentType: 'application/pdf',
+ }))
  })
 
  it('downloads with the key-derived context, ignoring a caller-supplied public context', async () => {
@@ -44,4 +68,23 @@ describe('downloadFileFromStorage context derivation', () => {
  expect.objectContaining({ key: userFile.key, context: 'workspace' })
  )
  })
+
+ it('uses the workspace ID embedded in an execution key to resolve generated artifacts', async () => {
+ const workspaceId = '2f1d8c3e-5b6a-4c7d-8e9f-0a1b2c3d4e5f'
+ const userFile: UserFile = {
+ id: 'f1',
+ name: 'report.pdf',
+ url: '',
+ size: 5,
+ type: 'text/x-python-pdf',
+ key: `execution/${workspaceId}/3f2e9d4c-6a7b-4d8e-9f0a-1b2c3d4e5f6a/4a3b2c1d-7e8f-4a9b-8c0d-1e2f3a4b5c6d/report.pdf`,
+ context: 'execution',
+ }
+
+ await downloadServableFileFromStorage(userFile, 'req-1', createLogger('test'))
+
+ expect(mockResolveServableDocBytes).toHaveBeenCalledWith(
+ expect.objectContaining({ workspaceId })
+ )
+ })
 })

apps/sim/lib/uploads/utils/file-utils.server.ts

@@ -16,6 +16,7 @@ import { StorageService } from '@/lib/uploads'
 import { isExecutionFile } from '@/lib/uploads/contexts/execution/utils'
 import {
  extractStorageKey,
+ extractWorkspaceIdFromExecutionKey,
  getFileExtension,
  getMimeTypeFromExtension,
  inferContextFromKey,
@@ -384,7 +385,11 @@ export async function downloadServableFileFromStorage(
  const { parseWorkspaceFileKey } = await import(
  '@/lib/uploads/contexts/workspace/workspace-file-manager'
  )
- const workspaceId = userFile.key ? (parseWorkspaceFileKey(userFile.key) ?? undefined) : undefined
+ const workspaceId = userFile.key
+ ? (parseWorkspaceFileKey(userFile.key) ??
+ extractWorkspaceIdFromExecutionKey(userFile.key) ??
+ undefined)
+ : undefined
 
  const { resolveServableDocBytes } = await import('@/lib/copilot/tools/server/files/doc-compile')
  const resolved = await resolveServableDocBytes({