fix(file): clamp a declared mount cap, and demand identity not full metadata

sandboxFiles reaches the sandbox layer from the request body, so a declared
maxBytes is a caller's number. It may now lower its own mount's ceiling but
never raise it past the one that layer guarantees.

The write path required full UserFile metadata, but size is never read
before the download and the download reports the real content type — so a
reference carrying id, key, url and name was rejected over two fields
nothing depends on. It now asks only for identity and fills the rest.

Uploads already made are also discarded when a later upload throws, not
only when a later file is refused for carrying a secret. Both exits leave
the harvest all-or-nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/execution/remote-sandbox/index.ts

@@ -269,7 +269,13 @@ async function writeSandboxInputs(
             URL: file.url,
             DST: file.path,
             DIR: dir,
-            MAX_BYTES: String(file.maxBytes ?? MAX_SANDBOX_URL_MOUNT_BYTES),
+            // Clamped, not just defaulted: `sandboxFiles` reaches this layer from
+            // the request body, so a declared ceiling is a caller's number. It may
+            // lower the limit for its own mount but never raise it past the one
+            // this layer guarantees.
+            MAX_BYTES: String(
+              Math.min(file.maxBytes ?? MAX_SANDBOX_URL_MOUNT_BYTES, MAX_SANDBOX_URL_MOUNT_BYTES)
+            ),
           },
           timeoutMs: Math.min(300_000, remainingSandboxBudgetMs(opts.signal)),
           maxOutputBytes: MAX_SANDBOX_PROCESS_OUTPUT_BYTES,

apps/sim/lib/function-execution/execute-request.ts

@@ -1955,54 +1955,62 @@ async function collectExecutionOutputFiles(args: {
   }
 
   const files: UserFile[] = []
-  for (const collected of args.collectedFiles) {
-    const buffer = Buffer.from(collected.contentBase64, 'base64')
-    const name = collectedFileName(collected.relativePath)
-    const mimeType = getMimeTypeFromExtension(getFileExtension(name))
-
-    // Scanned unconditionally — never gated on whether the bytes look textual.
-    // Both a filename check and a UTF-8 round-trip were trivially defeated: name
-    // the file `.png`, or append one invalid byte, and a plaintext secret sailed
-    // past. A lossy UTF-8 decode preserves ASCII runs, so a literal secret is
-    // findable in any buffer, textual or not.
-    //
-    // What stays out of reach is a secret carried in transformed form — deflated
-    // inside a PDF, re-encoded — which no substring scan can see. That is an
-    // inherent limit of scanning, not a hole in the gate, and it is why these
-    // files are execution-scoped rather than durable workspace files.
-    {
-      const provenance = await getOutputFileSecretProvenance(buffer, false, routeContext, {
-        userId: args.authUserId,
-        workspaceId: resolvedWorkspaceId,
-      })
-      // An execution-scoped file has nowhere to record a provenance envelope, so
-      // one carrying a resolved secret cannot ship under a lock the way a
-      // workspace file can — it is refused instead.
-      if (provenance.status !== 'exact' || provenance.entries.length > 0) {
-        await discardUploadedExecutionFiles(files)
-        return {
-          response: exportFailure(
-            `Sandbox output file "${name}" contains a resolved secret value and was not returned. Write the file without embedding secret values, or export it to a workspace file where its provenance can be recorded.`,
-            400,
-            args.stdout,
-            args.executionTime
-          ),
+  // The harvest is all-or-nothing, so a throw partway through has to take the
+  // uploads that already succeeded with it. Without this they linger in storage
+  // with nothing referencing them, since the failure response carries no keys.
+  try {
+    for (const collected of args.collectedFiles) {
+      const buffer = Buffer.from(collected.contentBase64, 'base64')
+      const name = collectedFileName(collected.relativePath)
+      const mimeType = getMimeTypeFromExtension(getFileExtension(name))
+
+      // Scanned unconditionally — never gated on whether the bytes look textual.
+      // Both a filename check and a UTF-8 round-trip were trivially defeated: name
+      // the file `.png`, or append one invalid byte, and a plaintext secret sailed
+      // past. A lossy UTF-8 decode preserves ASCII runs, so a literal secret is
+      // findable in any buffer, textual or not.
+      //
+      // What stays out of reach is a secret carried in transformed form — deflated
+      // inside a PDF, re-encoded — which no substring scan can see. That is an
+      // inherent limit of scanning, not a hole in the gate, and it is why these
+      // files are execution-scoped rather than durable workspace files.
+      {
+        const provenance = await getOutputFileSecretProvenance(buffer, false, routeContext, {
+          userId: args.authUserId,
+          workspaceId: resolvedWorkspaceId,
+        })
+        // An execution-scoped file has nowhere to record a provenance envelope, so
+        // one carrying a resolved secret cannot ship under a lock the way a
+        // workspace file can — it is refused instead.
+        if (provenance.status !== 'exact' || provenance.entries.length > 0) {
+          await discardUploadedExecutionFiles(files)
+          return {
+            response: exportFailure(
+              `Sandbox output file "${name}" contains a resolved secret value and was not returned. Write the file without embedding secret values, or export it to a workspace file where its provenance can be recorded.`,
+              400,
+              args.stdout,
+              args.executionTime
+            ),
+          }
         }
       }
-    }
 
-    const userFile = await uploadExecutionFile(
-      {
-        workspaceId: resolvedWorkspaceId,
-        workflowId: args.workflowId,
-        executionId: args.executionId,
-      },
-      buffer,
-      name,
-      mimeType,
-      args.authUserId
-    )
-    files.push(userFile)
+      const userFile = await uploadExecutionFile(
+        {
+          workspaceId: resolvedWorkspaceId,
+          workflowId: args.workflowId,
+          executionId: args.executionId,
+        },
+        buffer,
+        name,
+        mimeType,
+        args.authUserId
+      )
+      files.push(userFile)
+    }
+  } catch (error) {
+    await discardUploadedExecutionFiles(files)
+    throw error
   }
 
   // Registers the new keys on the execution so downstream blocks are authorized

apps/sim/lib/internal/file/operations.ts

@@ -12,7 +12,7 @@ import { acquireLock, releaseLock } from '@/lib/core/config/redis'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { ensureAbsoluteUrl } from '@/lib/core/utils/urls'
-import { isUserFileWithMetadata } from '@/lib/core/utils/user-file'
+import { isUserFile } from '@/lib/core/utils/user-file'
 import { durableSecretProvenanceFromPrivateBundle } from '@/lib/execution/durable-secret-provenance'
 import {
   inspectPrivateSecretProvenanceRequest,
@@ -791,13 +791,25 @@ export async function executeFileManageOperation(
          */
         let inputProvenance: WorkspaceFileSecretProvenance | undefined
         if (fileInput !== undefined && fileInput !== null) {
-          // Two shapes reach here and only one is already a UserFile. A block
-          // reference or an agent-resolved id arrives complete; the file picker
-          // stores `{name, path, key, size, type}` with no `id` or `url`, which
-          // the shared normalizer turns into one — the same conversion every
-          // other operation in this file applies to its own file input.
-          const sourceFile: UserFile | null = isUserFileWithMetadata(fileInput)
-            ? fileInput
+          /**
+           * Two shapes reach here and only one already identifies a file. A block
+           * reference, or an id the tool layer resolved through the execution
+           * index or workspace metadata, arrives carrying `id`/`key`/`url`/`name`.
+           * The file picker instead stores `{name, path, key, size, type}` with no
+           * `id` or `url`, which the shared normalizer turns into one — the same
+           * conversion every other operation in this file applies to its input.
+           *
+           * Identity is all that is demanded, deliberately. `size` is never read
+           * before the download and the download reports the real content type, so
+           * requiring them would reject an otherwise usable reference over two
+           * fields nothing depends on.
+           */
+          const sourceFile: UserFile | null = isUserFile(fileInput)
+            ? {
+                ...fileInput,
+                size: fileInput.size ?? 0,
+                type: fileInput.type ?? 'application/octet-stream',
+              }
             : fileInputToUserFile(fileInput)
           if (!sourceFile) {
             return Response.json(