fix(files): bound the shared artifact reads at the widest consumer ceiling

Review round 3.

The previous round bounded the compiled-artifact and cached-derivative reads at
the rendered-document ceiling, which is half what the serving routes will return.
That made the bound a policy rather than a backstop: an artifact between the two
figures was refused even though the route accepts a response that size, and a
derivative in that band read as a cache miss on every preview and re-transcoded
the original each time.

Both funnels now bound at the widest ceiling any of their consumers allows. A
consumer that permits less still enforces its own limit on what it got back — the
workspace download path continues to hold artifacts to the rendered-document
ceiling.

Author: icecrasher321

apps/sim/lib/copilot/tools/server/files/doc-compiled-store.test.ts

@@ -20,7 +20,7 @@ import {
   storeCompiledDoc,
 } from '@/lib/copilot/tools/server/files/doc-compiled-store'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
-import { MAX_RENDERED_DOCUMENT_BYTES } from '@/lib/uploads/utils/file-utils'
+import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
 
 describe('compiled document publication', () => {
   beforeEach(() => {
@@ -81,7 +81,7 @@ describe('compiled document publication', () => {
     // The artifact is fetched separately from the source that names it, so a source
     // that cleared its own ceiling says nothing about how large this is.
     expect(mockDownloadFile.mock.calls[1]?.[0]).toEqual(
-      expect.objectContaining({ maxBytes: MAX_RENDERED_DOCUMENT_BYTES })
+      expect.objectContaining({ maxBytes: MAX_BUFFERED_TRANSFER_BYTES })
     )
   })
 
@@ -95,8 +95,8 @@ describe('compiled document publication', () => {
     mockDownloadFile.mockRejectedValueOnce(
       new PayloadSizeLimitError({
         label: 'storage download',
-        maxBytes: MAX_RENDERED_DOCUMENT_BYTES,
-        observedBytes: MAX_RENDERED_DOCUMENT_BYTES + 1,
+        maxBytes: MAX_BUFFERED_TRANSFER_BYTES,
+        observedBytes: MAX_BUFFERED_TRANSFER_BYTES + 1,
       })
     )
 

apps/sim/lib/copilot/tools/server/files/doc-compiled-store.ts

@@ -3,7 +3,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { downloadFile, headObject, uploadFile } from '@/lib/uploads/core/storage-service'
-import { MAX_RENDERED_DOCUMENT_BYTES } from '@/lib/uploads/utils/file-utils'
+import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
 
 const logger = createLogger('CopilotDocCompiledStore')
 
@@ -75,6 +75,12 @@ async function loadPublishedArtifactPointer(key: string): Promise<PublishedArtif
  * about the size of this. Bounding it here rather than on the finished response is
  * what keeps an oversized artifact from being materialized before it is refused.
  *
+ * The bound is the WIDEST ceiling any consumer of this funnel allows, because it is a
+ * memory backstop and not a policy: a consumer that permits less enforces its own
+ * limit on what it got back (the workspace download path holds artifacts to
+ * `MAX_RENDERED_DOCUMENT_BYTES`, half of this). Using the tighter figure here instead
+ * would reject artifacts the serving routes are willing to return.
+ *
  * A size breach is rethrown rather than folded into `null`: null means "not built
  * yet", which callers answer with "still being prepared, try again", and an artifact
  * that is too large would retry forever behind that.
@@ -87,7 +93,7 @@ export async function loadCompiledDoc(
 ): Promise<Buffer | null> {
   const key = compiledArtifactKey(workspaceId, source, ext, referencedInputIdentity)
   try {
-    return await downloadFile({ key, context: 'copilot', maxBytes: MAX_RENDERED_DOCUMENT_BYTES })
+    return await downloadFile({ key, context: 'copilot', maxBytes: MAX_BUFFERED_TRANSFER_BYTES })
   } catch (error) {
     if (isPayloadSizeLimitError(error)) throw error
     return null

apps/sim/lib/uploads/server/image-derivative.ts

@@ -3,7 +3,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { downloadFile, uploadFile } from '@/lib/uploads/core/storage-service'
 import { isHevcHeifContainer, transcodeHeicToJpeg } from '@/lib/uploads/server/heic'
-import { MAX_RENDERED_DOCUMENT_BYTES } from '@/lib/uploads/utils/file-utils'
+import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
 
 const logger = createLogger('ImageDerivative')
 
@@ -21,13 +21,18 @@ function derivativeKey(storageKey: string): string {
  * A cache miss here is recoverable, so unlike the compiled-doc store this swallows a
  * size breach too: falling through re-transcodes the original, and the transcode is
  * bounded by the source read that produced its input.
+ *
+ * The ceiling matches what the serving routes will return for the same bytes. A
+ * tighter one would not reject anything — it would turn every read of a derivative
+ * in that band into a miss, re-transcoding the original on each preview, which costs
+ * more than serving the cached copy would have.
  */
 async function loadDerivative(storageKey: string): Promise<Buffer | null> {
   try {
     return await downloadFile({
       key: derivativeKey(storageKey),
       context: 'copilot',
-      maxBytes: MAX_RENDERED_DOCUMENT_BYTES,
+      maxBytes: MAX_BUFFERED_TRANSFER_BYTES,
     })
   } catch {
     return null