fix(files): restore workspace read-path behavior after rendered delivery (#9064)

* fix(files): restore workspace read-path behavior after rendered delivery

* fix(files): keep the delivery recheck for every principal and narrow the csv parser

* fix(files): keep the receipt recheck's provenance read typed for existing callers

Author: waleedlatif1

.claude/rules/sim-content-delivery.md

@@ -77,7 +77,7 @@ own unless noted.
 
 | Path | U | E | R / C |
 |---|---|---|---|
-| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Opaque: into a chat workbench with entries imported, so output is redacted; refused without one | Delivered |
 | File download (run_code proxy) | Refused before bytes enter workbench history | Recorded in workbench history | Delivered |
 | Requested mounts | Refused before code executes, listed in `excludedInputs`; later calls remain usable | Recorded in workbench history | Delivered |
 | File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |

.cursor/rules/sim-content-delivery.mdc

@@ -68,7 +68,7 @@ own unless noted.
 
 | Path | U | E | R / C |
 |---|---|---|---|
-| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Opaque: into a chat workbench with entries imported, so output is redacted; refused without one | Delivered |
 | File download (run_code proxy) | Refused before bytes enter workbench history | Recorded in workbench history | Delivered |
 | Requested mounts | Refused before code executes, listed in `excludedInputs`; later calls remain usable | Recorded in workbench history | Delivered |
 | File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |

apps/sim/app/api/files/serve/[...path]/route.test.ts

@@ -381,5 +381,36 @@ describe('File Serve API Route', () => {
       const response = await serveVersionedDoc(true)
       expect(response.headers.get('Cache-Control')).toBe('private, no-cache, must-revalidate')
     })
+
+    it('serves stored bytes under the type their extension names, not the recorded type', async () => {
+      mockResolveStoredFileContext.mockResolvedValue('workspace')
+      mockParseWorkspaceFileKey.mockReturnValue('test-workspace-id')
+      mockAuthenticateWorkspaceFile.mockResolvedValue(principal)
+      mockReadWorkspaceFileRecordByKey.mockResolvedValue({
+        file: {
+          id: 'file-1',
+          workspaceId: 'test-workspace-id',
+          name: 'export.csv',
+          key: 'workspace/test-workspace-id/export.csv',
+          type: 'application/vnd.ms-excel',
+          size: 3,
+          contentUpdatedAt: new Date('2026-09-06'),
+        },
+      })
+      fileUtilsServerMockFns.mockDownloadServableFileFromStorage.mockResolvedValue({
+        buffer: Buffer.from('a,b'),
+        contentType: 'application/vnd.ms-excel',
+      })
+
+      const response = await GET(
+        createMockRequest({
+          url: 'http://localhost:3000/api/files/serve/workspace/test-workspace-id/export.csv',
+        }),
+        createRouteContext({ path: ['workspace', 'test-workspace-id', 'export.csv'] })
+      )
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get('Content-Type')).toBe('text/csv')
+    })
   })
 })

apps/sim/app/api/files/serve/[...path]/route.ts

@@ -16,6 +16,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { CopilotFiles, isUsingCloudStorage } from '@/lib/uploads'
 import type { StorageContext } from '@/lib/uploads/config'
 import { readOrganizationChatAttachment } from '@/lib/uploads/contexts/organization-assistant/application'
+import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
 import { parseWorkspaceFileKey } from '@/lib/uploads/contexts/workspace/file-manager'
 import { downloadFile } from '@/lib/uploads/core/storage-service'
 import { resolveServableDocBytes } from '@/lib/uploads/documents/compile'
@@ -24,7 +25,7 @@ import { FILE_CACHE_CONTROL, workspaceFileCacheControl } from '@/lib/uploads/ser
 import { resolveServableImageBytes } from '@/lib/uploads/server/image-derivative'
 import { resolveStoredFileContext } from '@/lib/uploads/server/metadata'
 import { MAX_BUFFERED_TRANSFER_BYTES } from '@/lib/uploads/shared/types'
-import { inferContextFromKey } from '@/lib/uploads/utils/file'
+import { inferContextFromKey, resolveEffectiveMimeType } from '@/lib/uploads/utils/file'
 import { internalWorkspaceFileServeAuth } from '@/lib/workspace-files/api'
 import { fetchAuthorizedServableWorkspaceFileBuffer } from '@/lib/workspace-files/application/fetch-servable-workspace-file-buffer'
 import { finishFileDelivery } from '@/lib/workspace-files/application/finish-file-delivery'
@@ -116,9 +117,6 @@ async function resolveServableBytes(params: {
   workspaceId: string | undefined
   options: ServeOptions
   ownerKey: string | undefined
-  filePrincipal?: Principal
-  /** The stored record's content type, where the caller has the record. */
-  fileType?: string
   signal: AbortSignal | undefined
 }): Promise<ServableBytes> {
   // `raw` is the stored source, already bounded by the read that produced it, but it
@@ -146,29 +144,16 @@ async function resolveTransformedBytes(params: {
   workspaceId: string | undefined
   options: ServeOptions
   ownerKey: string | undefined
-  filePrincipal?: Principal
-  fileType?: string
   signal: AbortSignal | undefined
 }): Promise<ServableBytes> {
-  const {
-    buffer,
-    filename,
-    storageKey,
-    workspaceId,
-    options,
-    ownerKey,
-    filePrincipal,
-    fileType,
-    signal,
-  } = params
+  const { buffer, filename, storageKey, workspaceId, options, ownerKey, signal } = params
 
   // The pdf model for pages: a page file stores its SOURCE (frontmatter +
   // markdown + sim: fences) and serving compiles it to the rendered document,
   // the same way a .pdf key stores its script and serves the binary. Raw
   // requests above still return the source; bespoke/legacy HTML falls through
-  // untouched. Sim pages store an EXTENSIONLESS name — the record type marks
-  // them; legacy pages still carry .html.
-  if (fileType === SIM_PAGE_CONTENT_TYPE || filename.toLowerCase().endsWith('.html')) {
+  // untouched.
+  if (filename.toLowerCase().endsWith('.html')) {
     const text = buffer.toString('utf8')
     if (isSimPageSource(text)) {
       const rendered = Buffer.from(
@@ -195,9 +180,7 @@ async function resolveTransformedBytes(params: {
   const doc = await resolveServableDocBytes({
     rawBuffer: buffer,
     fileName: filename,
-    sourceMime: fileType,
     workspaceId,
-    filePrincipal,
     ownerKey,
     signal,
   })
@@ -246,9 +229,19 @@ function resolveServeCacheControl(
 ): string | undefined {
   if (context === 'workspace') return workspaceFileCacheControl(versioned, dependsOnReferencedFiles)
   if (versioned && !dependsOnReferencedFiles) return IMMUTABLE_CACHE_CONTROL
-  return context === 'workspace' || dependsOnReferencedFiles
-    ? WORKSPACE_REVALIDATE_CACHE_CONTROL
-    : undefined
+  return dependsOnReferencedFiles ? WORKSPACE_REVALIDATE_CACHE_CONTROL : undefined
+}
+
+/**
+ * The type a rendered workspace file is served under. A rendered Sim page is HTML; every other
+ * representation is named by the file's extension, as {@link resolveServableDocBytes} names it for
+ * local and cloud files, rather than by the stored record's type, so a `.csv` recorded as
+ * `application/vnd.ms-excel` still opens inline.
+ */
+function renderedWorkspaceContentType(file: WorkspaceFileRecord, renderedType: string): string {
+  return file.type === SIM_PAGE_CONTENT_TYPE && renderedType === 'text/html'
+    ? renderedType
+    : resolveEffectiveMimeType(undefined, file.name)
 }
 
 /**
@@ -418,7 +411,16 @@ export const GET = withRouteHandler(
         logger.info('Serve: document still compiling, returning 409', {
           message: error.message,
         })
-        return NextResponse.json({ error: 'Document is still being generated' }, { status: 409 })
+        return NextResponse.json(
+          { error: 'Document is still being generated' },
+          {
+            status: 409,
+            headers: {
+              'Cache-Control': FILE_CACHE_CONTROL.noStore,
+              'X-Content-Type-Options': 'nosniff',
+            },
+          }
+        )
       }
 
       const orchestrationError = asOrchestrationError(
@@ -462,29 +464,32 @@ async function handleWorkspaceFile(
   if (!workspaceId) throw new FileNotFoundError(`File not found: ${key}`)
 
   const input = { key, assertedWorkspaceId: workspaceId }
-  const { file } = await readWorkspaceFileRecordByKey.execute({ principal, input, request })
   if (request.method === 'HEAD') {
+    await readWorkspaceFileRecordByKey.execute({ principal, input, request })
     return new NextResponse(null, {
       headers: { 'Cache-Control': FILE_CACHE_CONTROL.noStore, 'X-Content-Type-Options': 'nosniff' },
     })
   }
+  let file: WorkspaceFileRecord
   let resolved: ServableBytes
   if (options.raw) {
-    const { content } = await readWorkspaceFileContentByKey.execute({ principal, input, request })
+    const read = await readWorkspaceFileContentByKey.execute({ principal, input, request })
+    file = read.file
     resolved = {
-      buffer: content,
+      buffer: read.content,
       contentType: getContentType(file.name),
       dependsOnReferencedFiles: false,
     }
   } else {
+    file = (await readWorkspaceFileRecordByKey.execute({ principal, input, request })).file
     const rendered = await fetchAuthorizedServableWorkspaceFileBuffer(file, principal, {
       maxBytes: MAX_BUFFERED_TRANSFER_BYTES,
       signal: request.signal,
     })
     const preview = options.preview ? await resolveServableImageBytes(rendered.buffer, key) : null
     resolved = {
       buffer: preview?.buffer ?? rendered.buffer,
-      contentType: preview?.contentType ?? rendered.contentType,
+      contentType: preview?.contentType ?? renderedWorkspaceContentType(file, rendered.contentType),
       dependsOnReferencedFiles: rendered.dependsOnReferencedFiles,
     }
     assertKnownSizeWithinLimit(
@@ -493,6 +498,7 @@ async function handleWorkspaceFile(
       'served file response'
     )
     await finishFileDelivery({
+      principal,
       authorize: () => readWorkspaceFileRecordByKey.authorize({ principal, input, request }),
       receipt: rendered.receipt,
     })

apps/sim/app/api/workspaces/[id]/files/inline/route.ts

@@ -10,6 +10,15 @@ import { readWorkspaceInlineFile } from '@/lib/workspace-files/application/read-
 
 export const dynamic = 'force-dynamic'
 
+/**
+ * GET /api/workspaces/[id]/files/inline?key=<cloudKey>|fileId=<id>
+ *
+ * Serves an embedded workspace image. A URL naming the exact storage object that was streamed is
+ * cached immutably (see {@link ReadWorkspaceInlineFileResult.contentAddressed}): a content write
+ * never rewrites an object, and every document render asks for each image at least twice (the
+ * editor's DOM, then its React node view) across two editor mounts, so revalidating re-downloaded
+ * every image on every open. A URL naming the file, whose bytes move as it is edited, revalidates.
+ */
 export const GET = defineInternalBinaryRoute({
   contract: getInlineWorkspaceFileContract,
   auth: internalSessionAuth,

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image.test.ts

@@ -23,10 +23,4 @@ describe('content-source resolveImageSrc', () => {
       '/api/files/public/tok_1/inline?fileId=wf_abc'
     )
   })
-  it('preserves the canonical Project owner on public sources', () => {
-    const owner = { entityType: 'project', entityId: 'project-1' } as const
-    const source = createPublicFileContentSource('tok_1', '/api/files/public/tok_1/content', owner)
-    expect(source.owner).toEqual(owner)
-    expect(source.buildUrl('ignored')).toBe('/api/files/public/tok_1/content')
-  })
 })

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -77,7 +77,6 @@ export type ResolvedSecretIncompletenessReason =
   | 'table-run-state-provenance-unavailable'
   | 'mounted-file-provenance-unavailable'
   | 'workspace-file-provenance-unknown'
-  | 'project-file-provenance-unavailable'
   | 'file-source-unidentified'
   | 'table-snapshot-unsafe-for-mount'
   | 'restored-provenance-untrusted'

apps/sim/hooks/use-file-content-source.tsx

@@ -57,7 +57,6 @@ export interface ImageDimensionsSource {
  * this source so the same components work in both contexts.
  */
 export interface FileContentSource {
-  owner?: EditableFileOwner
   buildUrl: (key: string, opts?: FileContentUrlOptions) => string
   /**
    * Map an embedded image `src` to a display URL scoped to the current context: the in-app source
@@ -91,7 +90,6 @@ function inlineImageSource(
   owner?: EditableFileOwner
 ): FileContentSource {
   return {
-    owner,
     buildUrl,
     resolveImageSrc: (src) => {
       if (!src) return src

apps/sim/lib/file-parsers/csv-preview-slice.test.ts

@@ -82,19 +82,23 @@ describe('getCsvPreviewSlice', () => {
   })
 })
 
-it('rejects an oversized streamed record before consuming the entire file', async () => {
+it('ends at an oversized streamed record with the rows before it, without consuming the file', async () => {
   let chunksRead = 0
   const source = Readable.from(
     (async function* () {
-      yield Buffer.from('header\n"')
+      yield Buffer.from('header\nfirst\n"')
       for (let i = 0; i < 1000; i++) {
         chunksRead++
         yield Buffer.alloc(16 * 1024, 'x')
       }
     })()
   )
   mockDownloadFileStream.mockResolvedValue(source)
-  await expect(getCsvPreviewSlice(args)).rejects.toMatchObject({ code: 'CSV_MAX_RECORD_SIZE' })
+  await expect(getCsvPreviewSlice(args)).resolves.toEqual({
+    headers: ['header'],
+    rows: [['first']],
+    truncated: true,
+  })
   expect(chunksRead).toBeLessThan(30)
   expect(source.destroyed).toBe(true)
 })
@@ -111,7 +115,40 @@ it('bounds bytes consumed even when blank records produce no preview rows', asyn
     })()
   )
   mockDownloadFileStream.mockResolvedValue(source)
-  await expect(getCsvPreviewSlice(args)).rejects.toThrow('CSV preview')
+  await expect(getCsvPreviewSlice(args)).resolves.toEqual({
+    headers: ['header'],
+    rows: [],
+    truncated: true,
+  })
   expect(chunksRead).toBeLessThan(140)
   expect(source.destroyed).toBe(true)
 })
+
+it('returns the leading rows of a file whose rows exhaust the byte budget before the row cap', async () => {
+  const wide = 'x'.repeat(10 * 1024)
+  const source = Readable.from(
+    (async function* () {
+      yield Buffer.from('id,payload\n')
+      for (let i = 0; i < CSV_PREVIEW_MAX_ROWS + 100; i++) yield Buffer.from(`${i},${wide}\n`)
+    })()
+  )
+  mockDownloadFileStream.mockResolvedValue(source)
+  const slice = await getCsvPreviewSlice(args)
+  expect(slice.truncated).toBe(true)
+  expect(slice.headers).toEqual(['id', 'payload'])
+  expect(slice.rows.length).toBeGreaterThan(0)
+  expect(slice.rows.length).toBeLessThan(CSV_PREVIEW_MAX_ROWS)
+  expect(slice.rows.map(([id]) => id)).toEqual(slice.rows.map((_, index) => String(index)))
+})
+
+it.each([
+  ['a quote followed by other characters', 'a,b\n1,2\n"x"y,3\n'],
+  ['a quote left open at the end of the file', 'a,b\n1,2\n"open,3'],
+])('skips a malformed record with %s instead of failing the preview', async (_, text) => {
+  mockDownloadFileStream.mockResolvedValue(streamOf(text))
+  await expect(getCsvPreviewSlice(args)).resolves.toEqual({
+    headers: ['a', 'b'],
+    rows: [['1', '2']],
+    truncated: false,
+  })
+})