fix(files): route the raw serve branch through the same response ceiling

The `raw=1` branch returned before the check, so the ceiling held for the
branches that transform bytes but not for the one that returns them unchanged.
Those bytes are already bounded by the read that produced them, so this changes
no behavior — it makes the guarantee hold for everything the resolver returns
rather than for every branch someone remembered to cover.

Author: icecrasher321

apps/sim/app/api/files/public/[token]/content/route.ts

@@ -129,7 +129,7 @@ export const GET = withRouteHandler(
       // replace it with bytes fetched or produced separately — a compiled artifact, a
       // page with its images inlined, a transcoded derivative. This is an anonymous
       // route, so the bytes it actually returns are what has to fit.
-      assertKnownSizeWithinLimit(buffer.length, MAX_BUFFERED_TRANSFER_BYTES, 'served file render')
+      assertKnownSizeWithinLimit(buffer.length, MAX_BUFFERED_TRANSFER_BYTES, 'served file response')
 
       logger.info('Public shared file served', { token, key: file.key, size: buffer.length })
 

apps/sim/app/api/files/serve/[...path]/route.ts

@@ -94,30 +94,16 @@ async function resolveServableBytes(params: {
   fileType?: string
   signal: AbortSignal | undefined
 }): Promise<{ buffer: Buffer; contentType: string }> {
-  const {
-    buffer,
-    filename,
-    storageKey,
-    workspaceId,
-    options,
-    ownerKey,
-    filePrincipal,
-    fileType,
-    signal,
-  } = params
-  if (options.raw) return { buffer, contentType: getContentType(filename) }
-  return withinTransferCeiling(await resolveTransformedBytes(params))
-}
-
-/** Rejects a resolved response whose bytes outgrew what one request may hold resident. */
-function withinTransferCeiling(resolved: { buffer: Buffer; contentType: string }): {
-  buffer: Buffer
-  contentType: string
-} {
+  // `raw` is the stored source, already bounded by the read that produced it, but it
+  // goes through the same check so the ceiling holds for everything this returns
+  // rather than for every branch someone remembered to cover.
+  const resolved = params.options.raw
+    ? { buffer: params.buffer, contentType: getContentType(params.filename) }
+    : await resolveTransformedBytes(params)
   assertKnownSizeWithinLimit(
     resolved.buffer.length,
     MAX_BUFFERED_TRANSFER_BYTES,
-    'served file render'
+    'served file response'
   )
   return resolved
 }

apps/sim/lib/file-parsers/yaml-limits.test.ts

@@ -36,10 +36,13 @@ describe('measureYamlExpansion', () => {
     const shared = [1, 2, 3, 4, 5]
     const aliased = { a: shared, b: shared, c: shared }
 
-    const measured = measureYamlExpansion(aliased, limits({ maxNodes: 20 }))
-    expect(measured).toEqual({ within: true, depth: 2 })
-    // 18 nodes if every reach is charged; 8 if the shared array were counted once.
-    expect(measureYamlExpansion(aliased, limits({ maxNodes: 12 })).within).toBe(false)
+    // 19 nodes when every reach is charged (root + 3 refs + 3x5 elements); 9 if the
+    // shared array were counted once, which is what makes an alias bomb invisible.
+    expect(measureYamlExpansion(aliased, limits({ maxNodes: 19 }))).toEqual({
+      within: true,
+      depth: 2,
+    })
+    expect(measureYamlExpansion(aliased, limits({ maxNodes: 18 })).within).toBe(false)
   })
 
   it('terminates on a self-referential anchor instead of recursing forever', () => {