fix(copilot): keep the too-large placeholder when the download cap trips

The recorded size is client-declared, so the download's maxBytes is the check
that actually holds. Breaching it threw past the placeholder and surfaced as a
failed read on all three capped paths.

Rethrow PayloadSizeLimitError unwrapped from fetchWorkspaceFileBuffer so callers
can tell a size breach from a transport error, and answer with the same
too-large placeholder the recorded-size check already returns.

Author: waleedlatif1

apps/sim/lib/copilot/vfs/file-reader.test.ts

@@ -15,6 +15,7 @@ vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
 }))
 
 import { readFileRecord } from '@/lib/copilot/vfs/file-reader'
+import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 
 const MAX_IMAGE_READ_BYTES = 5 * 1024 * 1024
 const MAX_IMAGE_SOURCE_BYTES = 25 * 1024 * 1024
@@ -85,6 +86,19 @@ describe('readFileRecord', () => {
     SHARP_TEST_TIMEOUT_MS
   )
 
+  it('reports the too-large placeholder when a understated record.size hides an oversized object', async () => {
+    // `record.size` is client-declared, so the download cap is the check that holds —
+    // and breaching it must still read as "too large", not as a failed read.
+    fetchWorkspaceFileBuffer.mockRejectedValue(
+      new PayloadSizeLimitError({ label: 'workspace file', maxBytes: MAX_IMAGE_SOURCE_BYTES })
+    )
+
+    const result = await readFileRecord(imageRecord('understated.png', 1024))
+
+    expect(result?.attachment).toBeUndefined()
+    expect(result?.content).toContain('Image too large to read inline')
+  })
+
   it('rejects an oversized image on its stored size before fetching it', async () => {
     const result = await readFileRecord(imageRecord('huge.png', MAX_IMAGE_SOURCE_BYTES + 1))
 

apps/sim/lib/copilot/vfs/file-reader.ts

@@ -12,6 +12,7 @@ import { TraceEvent } from '@/lib/copilot/generated/trace-events-v1'
 import { TraceSpan } from '@/lib/copilot/generated/trace-spans-v1'
 import { recordFileRead } from '@/lib/copilot/request/metrics'
 import { markSpanForError } from '@/lib/copilot/request/otel'
+import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { fetchWorkspaceFileBuffer } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { isHeifContainer, transcodeHeicToJpeg } from '@/lib/uploads/server/heic'
@@ -79,6 +80,29 @@ function getExtension(filename: string): string {
   return dot >= 0 ? filename.slice(dot + 1).toLowerCase() : ''
 }
 
+/**
+ * Download a record under an authoritative byte cap, returning null when the stored
+ * object breaches it. `record.size` is client-declared, so a caller's own size check
+ * can pass while the real bytes do not — this is the check that actually holds, and
+ * null lets the caller answer with its too-large placeholder rather than a read failure.
+ */
+async function fetchWithinLimit(
+  record: WorkspaceFileRecord,
+  maxBytes: number
+): Promise<Buffer | null> {
+  try {
+    return await fetchWorkspaceFileBuffer(record, { maxBytes })
+  } catch (err) {
+    if (!isPayloadSizeLimitError(err)) throw err
+    logger.warn('Workspace file exceeded its read cap', {
+      fileName: record.name,
+      recordedSize: record.size,
+      maxBytes,
+    })
+    return null
+  }
+}
+
 function detectImageMime(buf: Buffer, claimed: string): string {
   if (buf.length < 12) return claimed
   if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return 'image/jpeg'
@@ -404,18 +428,22 @@ export async function readFileRecord(record: WorkspaceFileRecord): Promise<FileR
         // image down the binary path where the model never sees it.
         if (isImageFileType(resolveEffectiveMimeType(record.type, record.name))) {
           span.setAttribute(TraceAttr.CopilotVfsReadPath, CopilotVfsReadPath.Image)
-          // `record.size` is client-declared, so it only buys the friendly placeholder;
-          // the download's own `maxBytes` is what actually bounds the bytes read.
+          // `record.size` is client-declared, so it only skips a doomed download; the
+          // download's own `maxBytes` is what actually bounds the bytes read. Both
+          // answer with the same placeholder.
+          const imageTooLarge = {
+            content: `[Image too large to read inline: ${record.name} (${record.size} bytes, limit ${MAX_IMAGE_SOURCE_BYTES})]`,
+            totalLines: 1,
+          }
           if (record.size > MAX_IMAGE_SOURCE_BYTES) {
             span.setAttribute(TraceAttr.CopilotVfsReadOutcome, CopilotVfsReadOutcome.ImageTooLarge)
-            return {
-              content: `[Image too large to read inline: ${record.name} (${record.size} bytes, limit ${MAX_IMAGE_SOURCE_BYTES})]`,
-              totalLines: 1,
-            }
+            return imageTooLarge
+          }
+          const originalBuffer = await fetchWithinLimit(record, MAX_IMAGE_SOURCE_BYTES)
+          if (!originalBuffer) {
+            span.setAttribute(TraceAttr.CopilotVfsReadOutcome, CopilotVfsReadOutcome.ImageTooLarge)
+            return imageTooLarge
           }
-          const originalBuffer = await fetchWorkspaceFileBuffer(record, {
-            maxBytes: MAX_IMAGE_SOURCE_BYTES,
-          })
           const prepared = await prepareImageForVision(originalBuffer, record.type)
           if (!prepared.ok) {
             span.setAttribute(TraceAttr.CopilotVfsReadOutcome, CopilotVfsReadOutcome.ImageTooLarge)
@@ -450,15 +478,20 @@ export async function readFileRecord(record: WorkspaceFileRecord): Promise<FileR
 
         if (isReadableFileType(record.type)) {
           span.setAttribute(TraceAttr.CopilotVfsReadPath, CopilotVfsReadPath.Text)
+          const textTooLarge = {
+            content: `[File too large to display inline: ${record.name} (${record.size} bytes, limit ${MAX_TEXT_READ_BYTES})]`,
+            totalLines: 1,
+          }
           if (record.size > MAX_TEXT_READ_BYTES) {
             span.setAttribute(TraceAttr.CopilotVfsReadOutcome, CopilotVfsReadOutcome.TextTooLarge)
-            return {
-              content: `[File too large to display inline: ${record.name} (${record.size} bytes, limit ${MAX_TEXT_READ_BYTES})]`,
-              totalLines: 1,
-            }
+            return textTooLarge
           }
 
-          const buffer = await fetchWorkspaceFileBuffer(record, { maxBytes: MAX_TEXT_READ_BYTES })
+          const buffer = await fetchWithinLimit(record, MAX_TEXT_READ_BYTES)
+          if (!buffer) {
+            span.setAttribute(TraceAttr.CopilotVfsReadOutcome, CopilotVfsReadOutcome.TextTooLarge)
+            return textTooLarge
+          }
           const content = buffer.toString('utf-8')
           const lines = content.split('\n').length
           span.setAttributes({
@@ -472,19 +505,25 @@ export async function readFileRecord(record: WorkspaceFileRecord): Promise<FileR
         const ext = getExtension(record.name)
         if (PARSEABLE_EXTENSIONS.has(ext)) {
           span.setAttribute(TraceAttr.CopilotVfsReadPath, CopilotVfsReadPath.ParseableDocument)
+          const documentTooLarge = {
+            content: `[Document too large to parse inline: ${record.name} (${record.size} bytes, limit ${MAX_PARSEABLE_READ_BYTES})]`,
+            totalLines: 1,
+          }
           if (record.size > MAX_PARSEABLE_READ_BYTES) {
             span.setAttribute(
               TraceAttr.CopilotVfsReadOutcome,
               CopilotVfsReadOutcome.DocumentTooLarge
             )
-            return {
-              content: `[Document too large to parse inline: ${record.name} (${record.size} bytes, limit ${MAX_PARSEABLE_READ_BYTES})]`,
-              totalLines: 1,
-            }
+            return documentTooLarge
+          }
+          const buffer = await fetchWithinLimit(record, MAX_PARSEABLE_READ_BYTES)
+          if (!buffer) {
+            span.setAttribute(
+              TraceAttr.CopilotVfsReadOutcome,
+              CopilotVfsReadOutcome.DocumentTooLarge
+            )
+            return documentTooLarge
           }
-          const buffer = await fetchWorkspaceFileBuffer(record, {
-            maxBytes: MAX_PARSEABLE_READ_BYTES,
-          })
           try {
             const { parseBuffer } = await import('@/lib/file-parsers')
             const result = await parseBuffer(buffer, ext)

apps/sim/lib/uploads/contexts/workspace/workspace-file-manager.ts

@@ -26,6 +26,7 @@ import { normalizeVfsSegment } from '@/lib/copilot/vfs/normalize-segment'
 import { canonicalWorkspaceFilePath, decodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { generateRestoreName } from '@/lib/core/utils/restore-name'
+import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import type { DbOrTx } from '@/lib/db/types'
 import { mergeEditIntoLiveFileDoc, notifyWorkspaceFilesChanged } from '@/lib/realtime/notify'
 import { getServePathPrefix } from '@/lib/uploads'
@@ -1251,6 +1252,10 @@ export async function fetchWorkspaceFileBuffer(
     return buffer
   } catch (error) {
     logger.error(`Failed to download workspace file ${fileRecord.name}:`, error)
+    // Rethrow a `maxBytes` breach unwrapped: callers distinguish "too large" from a
+    // transport failure to answer with their own placeholder, and re-wrapping it in a
+    // plain Error would erase the only thing that tells the two apart.
+    if (isPayloadSizeLimitError(error)) throw error
     throw new Error(`Failed to download file: ${getErrorMessage(error, 'Unknown error')}`)
   }
 }