fix(files): preserve valid zero-byte tool outputs (#7642)

* fix(files): preserve valid zero-byte tool outputs

* fix(files): keep url fallback and validate base64 canonically

Empty inline data no longer shadows a url. `''` and an empty Buffer now
produce a zero-byte buffer, which made `if (!buffer && data.url)` skip a
download that previously ran, so a tool emitting a placeholder alongside a
real url would have stored an empty file.

Replace the hand-rolled zero-length base64 check with the shared
`isCanonicalBase64`. `Buffer.from(x, 'base64')` silently drops characters
outside the alphabet, so `a!b!c!AAAA` and the non-canonical `AAAAA` decoded
to plausible-looking bytes instead of failing. Normalize first so the
payloads that already worked keep working: line-wrapped MIME base64,
unpadded base64url, and a base64 `data:` URI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VxZCGfFjZnokR8uFeWrfLp

* fix(files): reject whitespace-only base64 payloads

Normalization strips whitespace, so a nonempty payload of only spaces or
newlines collapsed to the empty encoding and was stored as a zero-byte file.
Only a payload that is empty before normalization is a legitimate zero-byte
file, so compare against the value after the data: URI prefix is removed —
which keeps an empty `data:text/plain;base64,` accepted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VxZCGfFjZnokR8uFeWrfLp

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Waleed Latif <walif6@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 4 people

apps/sim/executor/utils/file-tool-processor.test.ts

@@ -109,4 +109,128 @@ describe('FileToolProcessor', () => {
 
     expect(mockUploadExecutionFile).not.toHaveBeenCalled()
   })
+
+  it.each([Buffer.alloc(0), '', { type: 'Buffer', data: [] }])(
+    'stores valid zero-byte inline files as UserFile outputs: %j',
+    async (data) => {
+      const storedFile = {
+        id: 'empty-file',
+        key: 'workspace/workspace-1/empty-file',
+        name: 'empty.txt',
+        size: 0,
+        type: 'text/plain',
+        url: '/api/files/serve?key=workspace%2Fworkspace-1%2Fempty-file',
+      } satisfies UserFile
+      mockUploadExecutionFile.mockResolvedValue(storedFile)
+
+      const result = await FileToolProcessor.processToolOutputs(
+        { file: { name: 'empty.txt', mimeType: 'text/plain', data } },
+        toolConfig,
+        executionContext
+      )
+
+      expect(result.file).toEqual(storedFile)
+      expect(mockUploadExecutionFile).toHaveBeenCalledWith(
+        expect.objectContaining({ workspaceId: 'workspace-1', executionId: 'execution-1' }),
+        Buffer.alloc(0),
+        'empty.txt',
+        'text/plain',
+        'user-1'
+      )
+      expect(mockDownloadFileFromUrl).not.toHaveBeenCalled()
+    }
+  )
+
+  it('preserves empty file entries in file-array outputs', async () => {
+    const result = await FileToolProcessor.processToolOutputs(
+      { file: [{ name: 'empty.txt', mimeType: 'text/plain', data: '' }] },
+      { ...toolConfig, outputs: { file: { type: 'file[]' } } },
+      executionContext
+    )
+
+    expect(result.file).toHaveLength(1)
+    expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.alloc(0))
+  })
+
+  it.each([Buffer.alloc(0), '', { type: 'Buffer', data: [] }])(
+    'prefers the url over empty inline data: %j',
+    async (data) => {
+      mockDownloadFileFromUrl.mockResolvedValue(Buffer.from('downloaded'))
+
+      await FileToolProcessor.processToolOutputs(
+        {
+          file: {
+            name: 'file.txt',
+            mimeType: 'text/plain',
+            data,
+            url: 'https://example.com/file',
+          },
+        },
+        toolConfig,
+        executionContext
+      )
+
+      expect(mockDownloadFileFromUrl).toHaveBeenCalledWith(
+        'https://example.com/file',
+        expect.objectContaining({ userId: 'user-1' })
+      )
+      expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.from('downloaded'))
+    }
+  )
+
+  it.each([
+    ['line-wrapped base64', 'SGVsbG8s\nIHdvcmxkIQ=='],
+    ['unpadded base64url', 'SGVsbG8sIHdvcmxkIQ'],
+    ['a base64 data URI', 'data:text/plain;base64,SGVsbG8sIHdvcmxkIQ=='],
+  ])('decodes %s', async (_label, data) => {
+    await FileToolProcessor.processToolOutputs(
+      { file: { name: 'hello.txt', mimeType: 'text/plain', data } },
+      toolConfig,
+      executionContext
+    )
+
+    expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.from('Hello, world!'))
+  })
+
+  it('stores an empty base64 data URI as a zero-byte file', async () => {
+    await FileToolProcessor.processToolOutputs(
+      { file: { name: 'empty.txt', mimeType: 'text/plain', data: 'data:text/plain;base64,' } },
+      toolConfig,
+      executionContext
+    )
+
+    expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.alloc(0))
+  })
+
+  it('stores a successful zero-byte URL download', async () => {
+    mockDownloadFileFromUrl.mockResolvedValue(Buffer.alloc(0))
+
+    await FileToolProcessor.processToolOutputs(
+      { file: { name: 'empty.txt', mimeType: 'text/plain', url: 'https://example.com/empty' } },
+      toolConfig,
+      executionContext
+    )
+
+    expect(mockUploadExecutionFile.mock.calls[0]?.[1]).toEqual(Buffer.alloc(0))
+  })
+
+  it.each([
+    undefined,
+    null,
+    '!!!',
+    'a!b!c!AAAA',
+    'AAAAA',
+    '  \n\t ',
+    { type: 'Buffer', data: 'invalid' },
+  ])('does not turn missing or malformed data into an empty file: %j', async (data) => {
+    await expect(
+      FileToolProcessor.processToolOutputs(
+        { file: { name: 'invalid.txt', mimeType: 'text/plain', data } },
+        toolConfig,
+        executionContext
+      )
+    ).rejects.toThrow("Failed to process file output 'file'")
+
+    expect(mockUploadExecutionFile).not.toHaveBeenCalled()
+  })
 })

apps/sim/executor/utils/file-tool-processor.ts

@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
+import { isCanonicalBase64 } from '@/lib/api/contracts/primitives'
 import { isUserFile } from '@/lib/core/utils/user-file'
 import { uploadExecutionFile, uploadFileFromRawData } from '@/lib/uploads/contexts/execution'
 import { downloadFileFromUrl } from '@/lib/uploads/utils/file-utils.server'
@@ -16,6 +17,26 @@ const IMAGE_FILE_EXTENSIONS: Record<string, string> = {
   'image/webp': 'webp',
 }
 
+/**
+ * Strip a base64 `data:` URI prefix, leaving the encoded payload. An empty payload is
+ * a legitimate zero-byte file; a payload that only looks empty after normalization is
+ * not, so callers compare against what this returns rather than the raw value.
+ */
+function stripBase64DataUri(value: string): string {
+  return /^data:[^,]*;base64,/i.test(value) ? value.slice(value.indexOf(',') + 1) : value
+}
+
+/**
+ * Normalize a base64 payload to canonical RFC 4648 form so it can be validated: drop
+ * the line wrapping MIME encoders emit, translate the base64url alphabet, and restore
+ * the padding unpadded encoders omit.
+ */
+function normalizeBase64(payload: string): string {
+  const compact = payload.replace(/\s/g, '').replace(/-/g, '+').replace(/_/g, '/')
+  const remainder = compact.length % 4
+  return remainder === 0 ? compact : compact + '='.repeat(4 - remainder)
+}
+
 function assertFileSize(size: number, fileName: string): void {
   if (size > MAX_FILE_SIZE) {
     throw new Error(`File '${fileName}' exceeds the maximum allowed size of ${MAX_FILE_SIZE} bytes`)
@@ -169,29 +190,26 @@ export class FileToolProcessor {
         } else {
           throw new Error(`Invalid serialized buffer format for ${data.name}`)
         }
-      } else if (typeof data.data === 'string' && data.data) {
-        let base64Data = data.data
-
-        if (base64Data.includes('-') || base64Data.includes('_')) {
-          base64Data = base64Data.replace(/-/g, '+').replace(/_/g, '/')
-        }
+      } else if (typeof data.data === 'string') {
+        const payload = stripBase64DataUri(data.data)
+        const base64Data = normalizeBase64(payload)
 
         const paddingBytes = base64Data.endsWith('==') ? 2 : base64Data.endsWith('=') ? 1 : 0
         assertFileSize(Math.floor((base64Data.length * 3) / 4) - paddingBytes, data.name)
+        if (!isCanonicalBase64(base64Data) || (payload.length > 0 && base64Data.length === 0)) {
+          throw new Error(`File '${data.name}' has invalid base64 data`)
+        }
         buffer = Buffer.from(base64Data, 'base64')
       }
 
-      if (!buffer && data.url) {
+      if ((!buffer || buffer.length === 0) && data.url) {
         buffer = await downloadFileFromUrl(data.url, {
           maxBytes: MAX_FILE_SIZE,
           userId: context.userId,
         })
       }
 
       if (buffer) {
-        if (buffer.length === 0) {
-          throw new Error(`File '${data.name}' has zero bytes`)
-        }
         assertFileSize(buffer.length, data.name)
         const storedMetadata = resolveStoredFileMetadata(data.name, data.mimeType, buffer)